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^ From the Editor 



S eptember?!? I’m ncit sure about you, but this year seems to have gone by so quickly. Similarly, 
despite the amount of time weVe been looking at and hearing about Snow Leopard, 1 feel it 
breathing down my neck a bit. Are^yoz^ ready? Next month, well have plenty of Snow Leopard 
coverage. This month keeps filling you with the knowledge that yoti need to do you job nouK And 
there's a lot to know! 

The Mac in the Shell column once again focuses on Pydion, with a special emphasis on 
manipulating pUst files. Because they're so prolific on OS X, understanding plist files is a journey that 
every developer and Sys Admin should undertake. 

If you're responsible for managing site-wide software licenses, you probably either already use 
Sassafras’ KeyServer, or you've heard ai>out ii and are \^ery curious. If you have been struggling to 
make license management easier, Criss Myers shows yoti what KeyServer can do for you and how 
to do it. 

In the Road to Code, Dave Dribin covers a topic llial, externally, the people using your sijftware 
will take for granted: copy and paste. Read on and see whai it kxihi like from the other side and 
how to implement these essential operations. 

Attention, attention: if youTe at all hazy on how launchd can lie u.sed to run jobs ftrr you, this 
monili’s MacEnterprise column is a must read, Greg Neagle offers up some recipes for launchd plists 
that get you tlirough most common use cases. 

Casper is increasingly showing up as the management tool for Mac shops. It is an excellent suite 
t)f tcxrls, but there are certainly some nice tricks that you can pres.s into service that aren’t always 
completely obvious. In, “Extending the Casper vSuite with Dummy Packages," Miles A. Leacy shows 
tme such way to make managing Macs easier. 

MacTech has covered Microsoft’s Sharepoint m the past. In a mixed Windows and Mac 
environment, plus the latest service pack for Office 2008, SharePoint can provide a workflow and 
storage mechanism thafs currently tough to rival. There’s plenty to do, though, in terms of Sharepoint 
setup and customization, f^enelope Qwentry introduces you to SharePt)int Designer for those times 
where some extra customization will send you over the top. 

Michele Hjorleifs-son lirings us the fmal piece in his, “Demystifying PKl" series. This is where it 
all conies together Struggle with digital certificates and other public keys no more. 

WeTe really happy to feature Jeff Vogel in this mt>ntli's MacTech Spotlight. A long-time Mac- 
developer, he and the crew at Spider Web Solfw^are keep us eniertained with role playing game.s. 
There have been times when there has l>een a dearth of RPGs —or gamci; of any sort—on the Mac, 
hut Jeff has kept the fires burning in that category for over 15 years. 

As always, please let us know ytjur thoughts and feedback at lefters@mactech.com. Enjoy the 
issue, and well see you—and Snow Lecjpard—nexi riK^nth. 

Edward Marczak, 

Executive Editor 
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Mac in the Shell 

by Edward Marczak 

Reading and 
Writing piist Files 
with Python 

Tame those pesky plists 


Welcome 

Property list files, also known as *plists/ are pervasive in OS 
X. This article teaches you the basic inner-workings of the pHsl 
format, system level nielhtxis of working with piist files and 
how to interact with these files using Python under OS X. 

Anatomy 

Piist files are structured XML (extensible Markup 
Language) files and easily understandable. Essentially, a piist 
file is a way to store standard types of data. By '‘.standard,"* ] 
mean string, integer, B(Kjlean and so on, although there are 
ways to store art)itrary data as well. A piist file can easily be 
read into and written out from an NSDictionary t>bject. Thanks 
to PyObj-C, an NSDictionary can be mapped onto and 
manipulated with a Python-based dictionary object. 

Given the following dictionary: 

I 

color:, 
count:15, 
style;* fruit' 


the piist in LLsling 1 would be created 


Listing 1-example pUst file 

<?5cml verslon=''l .O'* encoding=”[jTF-8'*?> 

<lI}0CTyPE piist PUBLIC '‘■//Apple//DTD FLIST 1,0//EN" 
“http: //ww,apple,coni/DTDs/PtqpertyLiat‘l .0,dtd''> 
<pllBt verslDn='‘l.O'*) 

<dict> 


<key >c 0 1 0 r </key > 
<string)blue</string) 
<key )cQUllt< / key) 
<integer>15</lriteger> 
<key>style</key> 
(string)fruit</string) 
(/diet) 


(/piist) 


Let’s take a closer look at this piist. The header declares 
this file as an XML 

version^''! .0" encoding^"U7F-8"?) 

(mOGTYPE piist PUBLIC “-//Apple//DTU PLIST 1,0//EN" 

“http: / / wv, apple, com/DTDs /Property List 1,0, dtd " > 


Tltimately, this header lsn*t up to you. In this article, you1l 
see that Apple's Ccx:oa APIs will properly generate tliis upon 
writing a piist. For more information about XML, see the 
specificatitm page as http;//xml,org, or the Wikipedia entry at 
http;//en. wik(pedia,org/wik(/Xml, 

The piist tag wraps the entire file: 

(piist version*=*’ 1,0") 


Again, Apple's APIs will write this out as appropriate. Next, we 
find a dictionary^ tag: 

(diet) 


As 1 mentioned earlier, the structure we wrote out was a 
dictionary. In fact, that’s all you1l ever really do with piist files: 
read a piist into a dictionary or create one from semteh, and 
then let Apple's APIs write it out. 

Wrapped in the dictionary are its values: 


(key)color(/key) 
<striJig>blueC/string) 
(key>count</key) 
(integer)15(/integer) 

(key > s ty1e </key) 
(string)f riiit( / string) 


Follow ing this, the lags are closed and the file ends: 

(/diet) 

(/piist) 

Each tag should lead to a new level of indentation. Its easy 
to see the structure here. Best of all, ifs easily human-readable. 

However, beginning with OS X 10,5, the bulk of piist files 
found on the system are stored in a binary format, not plain 
text. While this does liave the effect of using less space on disk 
and faster load times, it takes the human-readable part out of 
the picture. Of course, there are ways to deal with that. 

System Tools - 

There are several ways to work with piist files, botli 
graphically and from the command line. Applets Property list 
Editor is installed as part of the free developer tools suite 
(Xcode ei al). In a standard iastall, it is found at 
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/Developer/Applications/Utilities/Property List Editor.a.pp. This 
is tlie easiest way to visualize a pllst. It’s also useful for creating 
a plist from scratch. Property List Editor can also edit entries in 
a plist file. 


^ _ cofln.mactech.eKampte pliit r Ci 
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Figure 1-Property List Ed]tor.app displaying the hierarchy 
of a plist file, 

while Property List Editor is fine for one-off plist work, it 
doesn’t really scale too well, Thai it doesn’t have a dictionary to 
use with AppleScript is just one example, What if you need to 
mcKlify a plist on thousands of machines? (Or even 15 
machines—iTs a pain to walk around to each machine and 
potentially interrupt people’s work. You may even want to 
update them after hours, while you're home). Once again, it's 
scripting to the rescue. 

There are several utilities for standard shell scripting or ad- 
hoc use. plutil, defaults and PlistBuddy all have 
different purposes and capabilities. 

plutil is the most liasic and utilitarian of the three, plutil, 
the plist utility, converts pli.st files between text (xml) and binary 
formats and can also verify the structure of a plist. An example 
is in order. If you want to view the contents of a binary [)llsi— 
com.apple.nat.plist, for example—but don’t care to open it in 
Property List Editor you can run this: 

plutil -convert Jtmll -o - 

/Lihrary/Preferences/com.appie.nat.plist 

(1’his makes a veiy^ nice alias: alias viewplist-"plutil 
-convert xmll -o - $1". Keep that in your 

.bash_profile). Running tliLs command tells plutil to convert the 
plist to text (“xmlT') and send the output (‘-o") to standard out. 
You could certainly write the output to another file on disk if 
you choose, 

plutil can also lint a file; that is, check it for consistency and 
basic errors. What it cannot do is verify that your key-names 
and data are correct. Running a lint check is as simple as 
passing in the -lint switch: 


$ plvtil -lint 

/Llbrary/Pteferences/com. apple. login-window.pllnt 
/Library/Preferences/notD.apple.loginwlndow.plist: OK 

If the lint process encounters an error (or errors, perhaps), 
you’re told the error and on wlrich line: 

$ plutil -lint someplist 

someplist: Encountered unknown tag stringblue^/string on 
line 6 

The defaults command gives you access to the user 
defaults system. The "'user defaults system” is a fancy way of 
saying “preferences,” which, you1l probably recognize as data 
stored in a plist file. Hie name is derived from the Cocoa API 
that performs the same task: NSUserDefaults. Hie defaults 
utility allows for reading and writing individual keys and tlieir 
data to and from a plist file, reading a plist in whole and more. 

Perhaps ihe simplest use of the defaults command is 
reading an entire plist file. This is ecjuivalent to the plutil 
command given earlier: 

$ defaults read /Library/Preferences/com.apple.nat 

I 

HatPortUapDisabled = 0; 
f 

The defaults command reads plist files of either xml or 
binary. However, it will only write a plist out in the binary 
variety. It will even go so far as to convert an xml plist into 
binary if used to update a value In that [>list. Do note that the 
target plist is specified wiiboui the plist extension. 

The defaults command, however, is not exactly a 
general-purpose plist utility like plutil or Propery List 
Editor.app. As mentioned, it works within the Ixmnds of the 
user defaults system. Hie upshot of this is that it expects plists 
to reside in .specific places: one of the Libraty/Preferences 
directories on the system. Do not rely on I he defaults cc}mmand 
to read and write arbitraiy piisis. (In 10.5 and 10.6, accessing 
arbitrary plist files is possible, however, that functionality is said 
to be going away, l^lus, youVe reading this article and will be 
learning better ways of handling this). One other .small problem 
with defaults: it's virtually impossible to work with values in 
nested dictionaries. Which brings us to Plist Buddy. 

PListBuddy started off a.s a utility that wa.s only found 
embedded into packages for Apple updates. Cleaily, Apple 
realized they needed a utility like this and developed it for their 
own use. As of Leopard, though, ifs a real part of the OS: it is 
found at /usr/libexec/PlistBuddy and even has a man 
page. While the defaults command can handle most tasks, 
PlistBuddy excels at editing keys and values in a nested 
dictionaiy^ - 
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Let's imagine our example plisL IcKiki like tliis: 

versions'll.0" encodings”UTF-S'7> 

<!D0CTYPE plist PUBLIC //Apple//DTD PLIST I.O//EH'' 

“http; / /ww. apple, com/DTDs/Property List-1 ,{),dtd“> 

<plist version="l,0"> 

<dict> 

<key>cDlor</key> 

<st rir3g>hlue</ string) 

<key>CQunt</key> 

<integer>l5(/integer) 

<key)ciis t _in f 0 < / key ) 

<dict> 

<key>pid</key) 

<string)98234573</string> 

<key>uid</key> 

<string>34B576</string) 

</dict) 

(key>style</key) 

<string>fruit</string> 

</dict> 

</pU 3 t> 

Notice that the key, \aJsLinlb” is a dictionary, railier than a simple, 
single value, PlistBuddy can easily update the vaktes in tliis 
nested dictionary. PlistBuddy can work interactively wliicli 1 
will not cover, hut can also p;iss in all commands using the V" 
switch, 'lb set the value of a key, you need the path to the key and 
die set command, 'llie path to the key starts with a colon (and 
uses a colon as the separator for each level in the hierarchy. Heres 
how to change d'set”) the value of the existing “pid” key to 
94758476, in die plist, "coin.mactech.exiimple.plist": 


/usr/libexec/PlistBuddy -c “Set :ciist_info:pid 94758476“ 

,/com.mactech.example.pi1 st 

(This is running the command in the same directoiy^ as the taiget 
plist. Oilierwise, youd need to specify the full path to the plist to 
edit). See the PlistBuddy man page (note the capitalization!) for 
more information on die udlity. PlistBuddy is capable of much, 
much more, inckiding copying values and meiging plist files. 

Accessing plists Via Python 

From time to time, as a s^^stem administrator, youH find 
yourself in a position where you'd like a .script to store its own 
preferences. Or, .simply have a script analyze a plist and ac1 on the 
contents in some manner. In many cases, hash scTipting that uses 
the commands already presented (plutil, PlistBuddy and, 
jxtiticularly, delaults) will he perfectly acceptable. However, for 
anything with a little tnore complexity, you may already l)e 
scripting in Pytlum (or |)erl, or Ruby, etc.). Since Mac in the Shell 
Ixis lx."cn focusing on Pytlion for the last several columns, we'll use 
it here as well. 

[pytlion, witli PyObj-C, rmikes tills trivial. More interestingly, 
you gel the best of hotli W'orlds: Apple's Al^Is along with Pytlion's 
ease of u.se and llie .speed of the edit and mn cycle (skipping the 
ccanpile step of C-based languages), To sec Uiis in action, let's start 
with nearly the most simple example possible. Listing 2 contains 
w^rite_plist.py, wliich demonstiutes creating a dictionary that gets 
written to a plist. 
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22/23" Cinema(ADC): $249/299 
15" Studio LCD(ADC): $49 
17" Studio LCD{ADC):$99 
ir Studio CRT, ADC/VGA: $49,99 
All Products are refurbished or 
demo call for more information. 


a 

S' 

PH I li 

1^11 







Don’t write off your 
trusted MacBook^. 



Introducing Axiotron* Modservice* — transform your ex/st/ng Apple* MacBook into an Axiotron Modbook'. 

It works like this: Sign up for Modservice.* Choose your upgrade options and the warranty you want. Turn in your computer to one 
of our Axiotron Authorized Service Providers for conversion. Then kick back and enjoy your new Modbook. Draw, sketch and write 
by putting a pen to the screen of the best tablet computer with Industry-leading Wacom’ Penabled* technology and Mac 05" X. 
Portable and versatile, the Modbook empowers your creativity and Imagination. 

With Axiotron Modservice, your Apple MacBook computer gets revitalized, renewed and revolutionized — into a whole new 
product, the award-winning Axiotron Modbook. Visit www.axiotrQn.com/modservice for details. 
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Listing 2-tvrite 

#1/usr/bin/python2*5 

ftom Foundatian import NSMutableDletionary 

my_dict ^ NSMutableDicticinary,dictlonary{) 

my_dict['color*] “ ’blue* 
my_dlct t■count * ] - 15 
myjlct [' style * ] = ' fruit * 

success ” 

my^dlct, writeToFile_atoiiiically_C * com. macteeb * example * pllst * * 1) 
if not successt 

print “plist failed to write]" 
sys-exltd) 

Upon running this pragnim, t’ciin.mactech.example.plist will 
ix^ cTeated in the s;ime working direetory as the program itself. The 
plist file will match the output that is shown in Listing 1. Let's 
examine this line-by-line to see how it works. 

Tlie very first line—#!/usr/bin/python2,5—is a good 
reminder that Python version 2*5 or higher Ls required for PyObj- 
C integration. Tliis will not work on Tiger systems out of the Ixix* 

from Foundation import NSMutableDlctionary 

This import is aisponsible for all of tlie magic here* Wlijle we could 
import all of Foundation, we’ll just import the portion we need: 
NSMulable Dictionary. 

my_dict = NSMutableDictionary^dictxonaryO 


Typically, creating a dictionary in Python would use airly braces, 
like this: 

new_dic t = [ i 

or, you can even fill it on creation: 

new^dlct = I’color* :’*blue* * *count':15, 'style':'fruit' I 

However, we need to create a real Cocoa NSMutableDictionary 
object, so thats what weVe done. Nicely, we c'an no go on and 
treat that just like a Python dictionary: 

my_dlctt*color*] ^ 'blue* 
my_dlct[*count*] = 15 
my _dict['style'] = 'fruit* 

You can use the Cocoa AP! [or adding entries to a dictionary as 
well: 

Gsy_dict*setValue_forKey_C'stop‘. 'state'] 

'fliLs would set the key 'state' to store the value *stop', and add the 
following to tlie plist once written out: 

<key>state</key> 

Cetring>stopC/stting> 

But* really. * .if you’m using Python, uike advantage of it where you 
c’an! (I suggest using ihe Python rnethod). You will need to use the 
Cfxioa API to write tlie dictionary out to disk as a plist file: 

success “ 

[ny_dict .writeToFile_atoiiilcally_('com. mac tech. example. plist', 1) 
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• Supports automatic rebuild in Mirroring mode 

• Flexible connection via USB 2.0 or FireWire 800 
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• Quad-interface via USB 2.0, FireWire 800/400, eSATA 
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• Simplifies RAID management, no software installation 

• Starting at $379.95 


Enter coupon code MACTECH for free shipping! 


www.oyendigital.com • info@oyendigital.com • 866.768.0659 
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Torn Edge 
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image as annotation 
Menu capture 
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Edit before capture , 
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Customize capture shortcuts 

Upload to Rickr Screen Capture 

Full Webpage Capture 


A great replacement and enhancement 
for your Mac’s screen-capture features, 
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presentations or even basic photo 
editing - Macworld 
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still want more reasons to try Voila - The best Mac Screen Capture Software? 
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The Ccx;oa writeToFileiatomically: method of NSMctionary (and, 
by exten.si(m, NSMutableDictionary) writes a property list 
representation of the contents of the dictionary to the patli given. 

if not success: 

print "pllst failed to writeP 
sys.escit {1} 

This final conditional tests to see if the writeToFileiatomically: 
method returned a Tnie F*success’') or False (Tailuie^*) value. Wliile 
not strictly necessary for this progmm to run, checking titese values 
is a good liabit to get into. 

Python Ease 

Just as a reminder, once you create tlie NSMutalMeDioionary, 
you Gin use standard Fytlion mechanisms to manipulate and 
traverse it. Adding a key with a dictionary as its value is as simpe 
as you'd expect. Just create the dictionary^ and tlien assign it to die 
parent dictionary. For example, to recreate the 
com.mactech.example.plist shown earlier, we wxiuld add the 
tbilowing to our program, after dealing die initial dictionary! 

siib^dlct = [ 1 

Bub,dict(‘uid^] = *348576' 
sub_dict[‘pid*] = *98234573* 
ii3y_dlct [*cust_iiifo'] = sub_dict 

Also, as shown earlier, you can also use all of the Cocoa APIs 
available to you to manipulate the dictionary as wed. The style you 
choose may be situation dependent. Some situations may aid for 
using the C^ocoa-way, wlille odiers may favor more l^honic 


writing. Wlien working with any Cocoa API, dicjugh, as always, 
you'll want to keep die documentation handy. 

Use It or Lose It 

This was an incredibly fun article to write. The topic is 
incredibly praciic'al lor everyday use. The plLst formal is pervasive 
duTJUghout OS X. Every technical person should have a familiarity 
with it, and System Admins should be even more deeply involved. 
While many erases can simply be solved with a single command- 
line call to defaults or PlistBuddy, anything with deeper 
involvement should use a scripting language like Python. The nice 
thing alxjut tlie scripting solution is that once you build up your 
library of routines, they're wmtteo and ready for re-use. Reading 
ahoy! it here rjnly gets you so fat Go write a .script and run it on 
a test system so you're ready lor the real thing when the 
opixjitunity arrives. 

Media of the month! Kick it old-schcx>l with vintage computer 
brtxrhures and manuals at httpr/Zassemblyman- 
eph. blogspotcom/2009/04/vinfoge- com puter-broebures. hhnL Full 
PDFs of how it used to be. 1 rememlier when taking one of my 
first computer courses, the teacher launching into the history of 
computing. Naturally, 1 just wanted to get into sitting at a computer 
and axJing. But now, perhaps more tlian ever liefoie, ifs ready 
useful to be able to frame our current experience with that which 
it was built on and evolved from. 

Next month, we’ll lie covering Snow Leofiard related topics! 
It’d lie two issues liefore we get Ixick to P>dion and scripting in 
general. Until dien, keep practicing. 
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Why designers, photographers 



It starts with the Quotes 


Quotes can be very detailed with up to 1,000 characters of description per detail line and 
up to 1,000 detail lines per quote, automatically printing on multiple pages. 


By coding your various company offerings, you can quickly modify template descriptions 
and get instant analysis of your most profitable and popular services 


Quotes along with all forms in MoneyWorks 
Gold can be customized to mair>tain your 
company's own Image and style. 


Show the columns of information, that you 
wish to show j.e, no qty., part numbers 
showing, or you can add information to the 
Quotes from User Defined fields and/or 
calculations. 


That automatically convert to jobs 


Accepted quotes can automatically (one click) convert into Sales Orders or can be processed as a Job, Project or Work Docket, using the Job 
Costing system, A Sales Order might be used if it was a simpie project with standard services listed. You can then process the different line items 
of the Sales Order into Invoices as each stage is completed, maintaining full control of the document identification for future reference and 
follow up. 


Job Costing on the other hand is used for more detailed projects, where you need to record time, third party resources, components, parts or 
products from multiple sources as well the basic services. 


Costs and details can be charged to various projects directly from 
supplier invoices, cash payments or via Time Sheet entry where 
you can quickly and easily record multiple resources to a single 
job or apply resources to multiple jobs i,e, time sheets from 
designers listing time spent on multiple projects during a week. 


MoneyWorks allows you to create budgets for each resource or milestone of 
your projects. Compare costs to actual to stay on top of profitability of every 
job. 

Costing methodology is customer defined for each Job, where you can 
establish a default margin for all costs incurred in a job, or use the actual costs 
for listed services, products, components etc. or establish individual costs for 
each resource used at the time of entry. 
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MoneyWorks' 

Seriously Good Accounting Software 


® MoneyWotts is a registered trademark of Cognftn Software Ltd. of New Zealand. Product specifications and avai^abnity are subject to change wrthout notice. MoneyWorks software Is subject to the of 
the licensing agreement included wrth the software. To review the English License before licensing the product, vasit our web site at http'/Avww.cxjgnito.co.nz, AJI rights reserved 
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Billing for Work in Progress 


Ail entries into a Job become pending items and pending Items can be billed at anytime. 
Invoices can be recorded in summary detail description, date stamped etc. Invoices can also 
be processed as unposted v/here you can add additional details or descriptions to each listed 
item as shown on the right 


Deposits or retainers can also be pre-received and 
recorded against the job and automatically be deducted 
from first, last or any invoicing period. 


Jobs remain open until the Final Invoice option is chosen 


Job Costing in MoneyWorks Gold can manage annual 
contracts that span your financial year, with MoneyWorks 
automatically keeping track of the work in progress and 
the accounting processes for you. 


MoneyWorks Gold Is serious about all the accounting functions, 
not just the Job Costing. 


Providing revenue, profitability and analysis reporting 



The Job Costing in MoneyWorks Gold lets you know where you stand for 
each and every job, the profitability for all current jobs, actual costs vs 
budget or how you are doing against deadlines. 


MoneyWorks provides many standard reports that will answer those 
questions and with the powerful built in Report Writer, owners or 
project managers can create custom reports that are possibly unique to 
theircompany orindastry/lTicDrporaTmglrrformatioriand'datafromatl 
areas of MoneyWorks. 


After all, MoneyWorks Gold is a full featured, double entry busir^ess 
accounting solution that incorporates all facets of accounting and 
managing a business. 


Job Costing is just one of the reasons that customers 
use MoneyWorks Gold. 


Job Costing is available in 
MoneyWorks Gold and Datacentre. 
Download a trial version at www.moneyworks.ca 


For more information about MoneyWorks 
email info@moneyworks.ca, call 800-818-6955 
or visit our web site at 

www.moneyworks.ca 
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Using Sassafras' KeyServer 
to Manage Licenses 


By Criss Myers 


Preface to the issues involved with 
licensing 

One of the many challenges that face an Apple Mac Netw^ork 
System Manager is the comol and management of Application 
software. One of die Issues involved in tills is licensing. Anyone 
who installs a piece of software lias a leg^il duty to comply witii die 
license agreement sliipped vvitlt die softwam. On a network, tliis 
challenge becomes mucli liarder wlien we tike into account diat 
we may have many more client macliines than available software 
licenses. There Is naturally no reason to purcliiise a single licease 
for every Mac on die nemtjrk when etidi application Ls not used 
concurrently on all the cliencs /&/. i\ote: Um dtpench on Ihe End 
L!si£?r License Agreerneni iiselfl With tills in mind there Ls a legal 
need to comply with tlie in.stalled licease agreemenis. Some 
softwaie developers have their own metins of contmlling their 
license agreements. Apple (iffers a "network aware volume license," 
Quark has their owm license server and many others u,se an iLt>k 
or USB dongle contrcjl fe4ituie. However the majority' of software 
available does not offer a network license: it Is shippeil widi a 
single use license. Even those diat do come widi a network license 
come with no means of enforcing this, or of preventing 
unauthorized launching of die software when ;ill licenses are used. 

Further licensing issues (xcur when a client imaging system Is 
used. One of the easiest ways to maruige a laigc numlier of 
netW'Orked Macs is to image diem centrally. 'Ehis meaas that each 
Mac has the same software installed onto it. Which also means diat 
the same license code is installed on to every diem during imaging. 
Some softw^are licenses ;ire network aware, but in general the same 
license code w^ill allow you to launch die software on eveiy' client 
at once. Tliis, of course, would breach the licease agreement. 

The Solution: Sassafras KeyServer 

One approtich to diLs problem is to use KeyServer by Sassafras 
Software. Sasstifras has lx."en around for nearly 20 years (since 
19901 Widi KeyServer, you can contol and monitor the ustige of 
each license on your network. The Kev^^rver manages your list of 
availalile licenses and grants access based on your license 
preferences; each client requires a KeyServer license. 

Tile server stiftwaie can lie installed on a OS X-liased server 
(c'an he OS X, or 05 X Sever), a Windows .server, a Novell server 
or a iiniLx server The client softw^are c^n be 111 n on a Mac, Linux 
or Windows client, w^hich means that the same solution am help 


you to contiol lx>di your Mac and Windows licenses fnim a single 
setup. A single KeyServer license will work on Ixjth platlbrnis, as 
die license Ls per client niachine registeied with die server, 
inelcvant of die platform from which it runs* 

In addition to controlling the software licenses, KeyTserver has 
the ability to monitor softw^are ustige, liecaase it can be set up to 
log all activity and display it as a graph over a given pericxl of dme. 
Tliis can help you to comply with auditor's requirements as well as 
feciliUiting the planning of future software puR’hases. 

Some of the benefits of using a KeyServer 

A license entry can lx? created fat any piece of .software. 

A license entry can lie keyed, preventing die software Irom being 
laundied, wiien die[e is ntj access to tire server. 

A ciueuing feature places diose di:u request an unavailible license 
in a queue, informing diem whan a license I’x^comes available. 
Releasing idle licenses for diosc who are queued 
A rc|X)rt of software usage can help tt> plm future softwaie 
purclrase and s*ive money on unnecc^s^uy purchases* 

Can lx? used for tracking computer usage and logons as well as 
license usage. 

Compare usage suits for various AppUcation.s such as Safari vs 
Firefox giving you an idea of dienis preferences. 

Setup and configuration of the 
Keyserver K2 

Installing the K2 Server and Shadows 

The KeyServer Ls easy to iasiall and setup. A full version of the 
software can be downkxided and installed from Sassafra-s for a limit 
period of time, for a limited number of clients for evaluation. Once 
you have downloiided the “KT .software to the server you need to 
install the K2Servei'.app on the seiver. When you purchase a license 
from .Sassafras you will receive a single license file, (".lie") 
extension, for die number of clients that you purchased. Place this 
in the KeyServer folder loc’ated at ‘"/Libniry/KeyServer/KeyServer 
Data Folder", If you purchase an maease to your numlx?r of clients 
you simply replace diis file. 

Figure 1 shows die server’s librar)^ folder containing the ks- 
StartSiop application,, die ks, KeySeiver Data Folder containing die 
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.lie license file and die KSddCoasLst Application, wliich diecks the 
coasLSiency of the KeyServer files. 
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_ KevServer Oaia folder 


*■ J to KeyActesf 
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** I to Keychains 

’JH KeySirver 
► to UunchAgents 
^ ’ to UiinchDaemofts 

to 

to Modem Soipti 

Fig 1. Library Folder. 



ks 


. kS-Sl4itSt0p 
^ KSdhCon&ist 


Once installed, the server can be started and stopped via the 
‘'ks-StartSiop" or via the command line executing the 'ks" 
executable. Hie server lequiies very little processor power, memory 
or disk spac'e. 'fhe K2ServTr will launch at startup after its first nin. 
Figure 2 shows die ks-StartSlop w'indow confirming that tlie 
KcTServer is running. 


ks-StartStop 


The KeyServer (version 6.1.4.2) Is running as: 
/Ubrary/KeyServer/ks ( process ID: 156 ) 

Shut it down? 

Cancel ^ ^ Shut Down ^ 


Fig 2, ks-StartStop 

Hie KeyServ'er supports w'hat are called ‘"sliadow^s" which are 
replicas of the main server, so that if the main server Is offline, the 
shadows can be usc*d to auihorize license requests and log usage. 

To create a shadow, you need to create a shadow license file 
via the K2 Admin tex)!, KeyConfigure. Hien, on a second server, 
replace the .lie file with the Shaclow.lic file. The fir^t time you start 
the Shadow KeyServer you will need lu .start it via the coriaiiand 
line, as you will need to enter die passwonl you cieaied when 
creating the Shadtiw license file. 


Admfn 


Reports Window Help 


KeyConfigure Accounts.., 
General Settings... 


Create Shadow Certiftcate. 


1 


Backup Schedule,,. 

Referral KeyServer... 

Mail Settings... 

Exporting... 

Log File Management... 

Authentication.,, 

KeyAccess Version Control... 

Figure 3. The KeyConfigure menu for creating 
a Shadow license. 


You will need to add die KeyServer to your firewall on Ixiih 
the main and shadow servers, die K2 pon Ls U?D ports 19283 and 
19315 and TCP port 19283* 

Installing the K2Client / K2Mobile and 
K2Admin tools 

The client software Ls installed via the K2Client.mkpg or the 
K2Mobile.nikpg. The difference lietween these two is that the 
mobile verriion allows you to sign out licenses on mobile clienLs for 
ase offline. The client iTLStaller instdis KeyAcceiiS, KeyVerify and a 
PreferencePane. Wlien you install die client, it asks for the address 
of the server, either via FQDNS or IP address. 



Figure 4. The K2 Client installer, the KeyServer Address is 
required before the installation starts. 


The PieferencePane allows you to logon to die Keyserver, and 
lists the available shadt>ws. Onat connected, the client will 
reconnect at each logon, Fwety time you login to the computer it 
will connea to the KeyServer and k?g die activity along with the 
k^ing of each license that is granted, denied or queued. 



Figure S. The PreferencePane shows you the status of the 
connection between the dient and the server as well as 
known Shadow servers as well as the version number, i.e. 
6.T.4.4 The first time you logon you get the above message. 

The K2 Server Ls administered from a client computer. 
Instilling the KZAdmin.mpkg wall in.siall the KeyConfigure 
application in the Applications folder When you kunchjthe. 
KeyConfigure Application it asks for the Server address and 
authentication. Hie default pas-swnnd is ‘‘Sassafras”. 

Figure 6 and 7 show die logon and password cliange 
windows. 
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Figure 6. The KeyCoitfigure login window. 



Figure 1 KeyGinfigure's request to change the default 
password. 


Configuration of the KeyServer 

Ke><x)nrigure Ls tlie Adiiiinistmtion pn:)gn4m for tlie entire 
eonfigumiion and monitoring of Uie KeyServer. llie ^'Wintiow'* 


menu g^ves you access to the various different windowpanes for 
monitoring and setting up the KeyServer 

Figure 8 shows the Window^ menu in KeyConfigure, this is 
where you open the various windowpanes. 
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Fig 8. KeyConfigure's Window menu. 



The first task after you have created a Shadow license is to 
setup the license entries for the piogmnis you wish to manage, 
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Open die "Licenses” windowp^me. This lists all the license entries 
you create. 

Figure 9 shows die license entries that have been setup. 
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Fig 9* License window pane 


To Lteate a license entiy, just drag the application icon onto 
diis license window. A new window^ then ofiens wtere you can 
.select the appropriate options, Choose from a ""Keyed Program” or 
an Tlnke^^ed Program''. I’he difference between Key and Unkeyed 
is that the appliaitions.app folder Ls mcKlificxl by die KeyServer so 
that the prognim cannot be launched witliout a valid connection to 
the Keyseiv^er. ITiLs prevents die program from being copied to 
another computer via CD or external drive. Some applications are 
self-contained widiin dieir .apji bundle folder which makes it easy 
to copy them to another machine. By keying the application, it can 
never Ix' opened an^wliere else. Some programs do like being 
keyed and once you key an application, you cannot unkey it 
wadioLit reinstalling, so make sure you test the applications you key. 
Click "Ok": tile entry is created and the advance window^ is opened. 

FigLEre 10 and Figure 11 show the configuration windows for 
setting up a license. 
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Fig 10. The new license entry aeation window Select 
between Keyed or Unkeyed and whether to allow the 
application to launch when fhe KeyServer is offline. 
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Fig 11. This window opens automatically after you create the 
license entry but can ^ accessed later by double clicking the 
entry in the license window. 


Some of the main features tliat am be ^set are: 

Limits: Choose the type of licease you possess, and tlie 
number of concLirrent licenses. Under Custom limits you can limit 
a license to certain groups, or create priority^ schedules for certain 
times. You can connect the Key’Server to a directory, such as active 
Directory, or LDAP to access existing groups. 

Idle: Here you can set wha! happens when the user stops 
using tlie program for a certain length of time. Each program can 
have its own settings or you can set global settings, which allows 
you to set the queuing preferences, lliis am very useful if you 
have a limited number of licenses but you exjx^ct that users may 
use the program for a short while and tlien leave it open. Tliis 
W'ould nonuidly prevent other uses from using tlie program, but 
them LS an option to queue new iet[uesLs for die program and 
eidier warn Lssers who are idle, ur cjuit the program from diem. 
Once a license Ls released due to idle seEings die queued user will 
be notified tliai a licease is now^ availalile for diem. 

Custom Messiige: Here you can create a me.s.sage tliat gets 
displayed on screen when the appliaition i.s launched. You can 
cretire a custom deny' or a queued message infonning the user of 
die reason why they cannot laiint h the progjam. You can also 
create a one-time or on going general launch message, for example, 
"'Hiis progmm may crash if you remove the camera before quitting 
the appliaition". 

Once you have create the licenses you tlien need to add the 
computers, Every computer mnniiig keyAccess diat logs on to the 
KcySeivcT gets audited by die KcyServer and added to the 
Xomputers'^ window's discovery' list. 

Figuie 12 shows the ‘"Compuleri" windowpane. 


a TELESTREA M Apple Design Award 

■ c ^ ^ 1 n C IVt Ww Matos XljPDpardAppllcatidti 

Record and Edit Your Onscreen Product Demos 



ScreenFlow Professional Screencasting Studio Makes It Easy 

Capture the contents of your entire desktop at the same time as your video camera, microphone and computer's audio. Showcase your 
iPhone application with iPhone emulation capture. Sophisticated editing tools allow you to create incredible screencasts in no time* The 
finished result Is a QuickTime movie, ready to drop right into your online product pages. 

For FREE trial and more information, visit www.telestream.net 




y 





































liKgag^hpMP^cks • FREE Business Cards f lREg 


If interested in 
becoming a 
RESELLER/BROKER 
please contact us at 
$ales@PriiitDirectforLess.com 


Up to 35% OFF 
list pricing 


PRICING • Full Color Printing 

(4/4) (4/4) 9"x12" (4/0) 

4^'X 6" POSTCARDS 5-5" POSTCARDS POCKET FOLDERS 


24 hour turnarounds 
available on most 
products 


2"x3.5" (4/4) 
BUSINESS CARDS 


8.5"x11" (4/4) 
TRI-FOLD BROCHURES 


EARN A GREAT 
2nd INCOME! 


ne Nation’s 

; r for 

' Printi^ 

direct Mail 
^^f'keting! 


GREAT prices...FAST turnaround! 


Hiiw.PrintDirectforLess.com 























Fig 12, Computers window. 

Eiich new coinpLiter has a pink discovery icon next to it, to 
acknowledge tire coniputerj right click on tlie name and select 
acknowlcxJge. You can customize tlie aitegories to display such as 
MAC] address and IP address. Under ilie divisions menu you can 
create separate divisions or computer groups. Yhis can help you 
when you cieate leports so that you c^i^in view usage or activity 
Ixised on computer groups. 

Now you have Uie KeySeiv'er installed and setup the iin:;rl thing 
to do is monitor us^ige and create reports. 

Figure 13 shows the caurently logged in coiiipiiters and users, 
Hiis windowpane shows the maximum clients available for tJie 
|:nirchased license as well as the name of the KeyServer, 
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Fig 13 The Users of the KeyServer 


r>ouble click on a user and you c'an view the licenses the>^ 
have signed out as well as the times that they logged in. You c'an 
also send a bulletin message to the user. 

Creating various reports and graphs 

Wlien you have used tlie KeyServer for a tew montlis and built 
up a diitalxrse of tisage, you can buikl reports. These will allow you 
IQ gather^ useful infomiation tliat can help you to plan for tlie future. 
Tliere are many leports you c'an create, to include data such as: 
computer u.sages, license usages, weekly and daily repx>rLs, logins, 
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list of denials etc. The data can be displayed as hislograim. To 
create a report you select die appropriate report from the “Reports" 
menu. You tlien get a popup box to edit tlie criteria. You can select 
other reports to run and then choose tlie time period in wldch to 
run the repoiLs. The resulting report can tlien be saved as either an 
html file or an xml file. 
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Fig 14. The KeyConfigure's reports popup window. 


Conclusion 

One of the many issues Mac system administrators liave to 
address is software liceasing and tracking. A Key Server solution 
ofTei’s a gre*it way of .solving this issue as well as offering other 
services. I'he softv^^are is easy to setup, retiuires limited resources 
and can have multiple hackmp serv^ers. It can manage any program 
as well as monitoring logins and logouts. You c'an add the 
KeySeiv'^er to a direcroiy service and then u.se existing groups to 
as.sign liceases. If you divide your computers into divi.sions you can 
tmck .softw'arc and computer use by division, if you wish to assign 
a division to a particukir building then you can compare usage 
between different physical locations, I'hen once semp you cTin use 
the rejiorting feature to analyse different usage patterns to enable 
you to plan for the hiture. There axe many other features that have 
not been discussed here, diar a Key’Sener cxin offer. Not only can 
tlie Key.Server monitor usage of license it can also control who has 
access imd when, w^hich means much greatei- llexibility in license 
m:tnagement. For more infomiation and to olitain a trial copy, go 
to www.sassofrosxom. 
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The Road to Code 

by Dave Dribin 


The Glue that 
Binds 

I^Copy and paste j 


it Faye rite Word 


Hit 


Edit 


Format View Window 
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Cut KX 
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f»ast€ 

Oeletf 

Set«ct AH XA 

Find ► 

Sp«iling and Grammar ¥ 
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Speech ► 


Special Characters 


One of ttie haltork features of nicxlem GUI cippliealions is 
tile abilit)' to copy content and paste it into either the same or a 
second, .separate application. In this month's article, we are going 
to add copy and paste to tlie Favorite Word application dial we 
develtiped in ilie June 2W) artide. As a cfuick refresher, our 
application Iilis a single window witli a custom viev^^ tliat displays 
your favorite word, as sliown in Figure 1. 


iW O O Wofd 


^^ 

Cocoa 



Figure 1: Favorite Word window 

The wrjrd can currently only Ix^ set in tlie application's 
preferences. We're going to add the ability' to copy, cut, and paste 
the w'ord in the custom view. In addition, if the user pastes a word, 
we're going to update die word in die preferences. 

It turns out that our application already has an Edit menu 
along with the Cut, Copy, and Paste menu items, since they're 
included with the standard application template, Howe\^er, il' you 
open the Edit menu, you’ll notice that all three are grayed out, as 
shown in Figute 2. 


Figure 2: Disabled Cut Copy, and Paste 


Before w^e delve into the code changes needed to bring copy, 
cut, and piiste to our application, we need to cover the first 
resfKjnder. the responder chain, and nil-targeted acUons topics. 

Responders 

In the April artide. A Whuiow mib a View, we talked about 
the view hierarchy and the MSResponder class. As a quick 
oven'iew, the view hierarchy is how views (sulxlasses of NSView) 
are anunged inside a w^indow. For example, the window^ in Figure 
3 lias a view hierarchy as shown in Figure 4, 

H O O Window 


A text field ( Button 


Figure 3: Window with text field and button 
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Also, the NSResponder class is the base class for all 
classes that participate in the Ccx:oa event handling system, and 
the NS View class is a subclass of NSResponder. This makes 
all views capable of handling eveoLs. In the April article, you 
learned how to handle mouse events by overriding the 
tnouseDown:, mouseUp:, and mouseDragged: methods of 
NSResponder. 

First Responder 

Even though windows contain rnultij^ile view,s, keyboard 
evenLs are only routed to one view that has the users focus. 
This focused view" is designated as the/i>^^ respcmder. Tlie first 
responder Is the first view that is given the opportunity to 
handle user events. It doesn't have to handle events, but it has 
tlie first opjx)rtunity to do so, As the user clicks or tabs around 
to other views in the window; the first responder changes. 

The way the first responder changes is a bit complicated, 
because the current first responder may refuse to give up its first 
responder status, or the view the user clicks on may reject first 
responder status. 

Responder Chain 

I mentioned above that the first responder gets first crack 
at handling keylx>ard evenrs. If a view decides not to liandle 
the event, the application kee[-)s trying to find a responder dial 
does handle die event. Tlie application will next ask the first 
re.sponder^s super view to handle the event, if this view does 
not handle the event, it continues up the view hierarchy. If 
none of the views handle the event, tiie NSWindow gets a 
chance to handle the event, and finally an 
NSWindowCont roller, if there is one. 

Nil-Targeted Actions 

In some case, the responder chain is aI.so u.sed for handling 
actions. In previous articles, we've used a specific target and 
selector to handle actions. For example, when we connect up 
a button’s action in Interface Builder by control-dragging to our 
controller class, it sets the target and selector of the button’s 
action, If we were to emulate this in code, it would look like: 

[button setTarget ^contraHerl: 

[button s&tActioni^eelectortbuttonPress&d:)!: 

This tells the button selector, in this case buttonPressed to 
call on a specific objecT controller. How^ever, the target 
does not need to be a specific object. Ii can be .set to nil 
w'hich has special meaning: to cal! the action selector on the 
first responder. If the first responder does not implement the 
action selector, then the application tries to find some olijecl to 
w^hich to send the action. To do this, it uses the responder 
chain in a similar manner to what 1 descried above for 
handling key events.^he precise nature of the responder chain 
for nil-targeted actions is a bit complicated, so for tlie exact 
rules, 1 suggest you read the Cocoa Et^nt-Haudling Guide on 
tlie Apple’s developer site. The imixirtant point to note is that 
the first responder gets to handle niTtarget events. 


Handling Copy, Cut, and Paste 
Actions 

So how^ does aU tills fit into copy, cut, and paste? As it turns 
out tlie Copy, Cut, and Paste menu items are not disabled because 
they are noi conneaed up to anything. They are actually 
connected to an action selector, but they are nil-targeted actioas. 
The copy, cut, and paste menu items iire connected to tlie following 
action seleaors, respectively: 

' (IBAetion)copy:(id)sender: 

- £ IMctiau) cut: (id) sender: 

- (IBActioQ)pa steiCid}senda r: 

The reason why the menu items are grayed out is l>ecause 
neither the first resptinder nor any object in die responder chain 
implements these methcKls. To fix this, we need make sure our 
custom view; Word View, lxx:onies first responder and dien 
imfilement these methods. 

NSView has a method named acceptsFirstRes ponder diat 
rcmms a BOOL: 

- (BCK)L)acceptsFitsi:Respoiider; 

Hie default implementation of tliis methtxl letums NO, meaning it 
cannot Ixx'ome the fust responder. Since our view currently tnnnot 
Ixcoine die first responder, it does not Ixcome part of the 
resjxinder cliain, and tlius is not eligible to handle die copy, cut, 
and paste action methods. Tlius. our first step is to override this 
mctliod to return YES in WordView.m: 

- (BOOLjacceptsFirstResponder 
t 

return YES; 

I 

Next, we need to implement the action methods, but let’s just 
use stubs for now; just to niake sum weVe got everything hooked 
up right: 

- (IBActiou)copy:(id)sender 
! 

NSLog£@'<Copy"): 

1 

- {IBActlon)cut;(id)sender 

NSLog(^"Cut"); 

I 

‘ £iBAction)pastes £ld)sender 
I 

NSLog(@"Paste"}; 

I 

If you am the application at this point, the Cut, Copy, and 
Paste menu items should lie selectable, and if you chose one, you 
should see the appropriate log message. 

How did that happen? Since our aistom view^ Ls the only view^ 
in the window, die window Ls going to ask it if it wants to liecome 
die first responder. Since the view accepts first responder status, it 
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becomes the first responder When the user dicks the Edit menu, 
the application checks tlie responder cliain for an object to handle 
the cut:, copy:, and paste: action metliods. Since our custom 
view does, and it’s the fiisi responder, the applic'ation knows it can 
send these actioas to our view^ and makes the menu items 
available. When the user actually selects, for example, the Copy 
menu item, the application sends tlie action to our view. 

The Pasteboard 

WeVe got the user interfac’e working properly, but now we 
actually need to implement the action methods. Copy and paste 
lietw'een applications is handled by the jKi^ehoard. The 
pasielx>ard lives outside of all applications and acTs as a mediator 
l^etween them to support copy and paste, Wlien a user copies 
some text, the .source application puts this text on the pastelxxird. 
When the user pastes in another application, the receiving 
application retrie\^es the to:t fiom the pastehx>ard. 

Cocoa has a class called NSPasteboard that prcwides an 
interhice to tlie piisteboard. It handles the low-level inter-process 
comniuniattion and makes implementing copy and paste rebtively 
straightforward. 

To implement copy, an applk’ation puts data on the 
pastelx}ard. An application may put multiple mpresenlations of the 
data on the pastelx>ard. For example, an application may put 
styled text as RTF or PDF as well as plain text on the pasteboard, 
Tlie application iliai receives data fn)m the pasteboard can choose 
the liCvSt representation for its needs. For example, TextEdit may 
chcxxse the styled text whereas Temiiiial may charse the plain text. 

Putting Data on the Pasteboard 

To put data on the pastelxiatd, you first need m instance of 
tlie NSPasteboard class. Then you tell it wliat types of data you 
are going to put on the pasiebt:)ard And Finally you put the actual 
data for each type on the pastelx>an.i. Mere's cfxle to put a string 
on the pa5telx)ard: 

NSStriDg ‘ string = string'"; 

NSPast^board * pasteboard ^ [NSPaeteboard ^ 
generalPasteboard]: 

NSArray * types “ [NSAtray "f 
arrayWithObj act:NSStringPbDardType]; 

ipaateboard declareTypesitypes owner:nil]; 

[pasteboard aetString:string forType:NSStrlngPboardType]: 

Wilile we are using a static string, the string variable w{)uld 
come tmm tlie view, as we siiaM soon see. There are multiple 
different pastelxxirtLs in the system, but the general pasteboard is 
u.sed for copy Lind jxiste. Y<ju can get a reference to the general 
pastehcxud by using the +generalPasteboard class method. 
Tile declareTypes: owner: metliod tells tlie pastelxsard which 
types of data you am going to put on die pastelxxard. You pass it 
an array of types, ordered i>y preference of type, with the preferred 
type first. The NSStringPboardType is a constant for plain text 
type, rf an application uses rich text and plain text, it probably 
wants to use the rich text first. Since this example uses only plain 
text, tliat's all we need. Finally we pul the plain text on die 
pasteboard using the setString:forType: method. 
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When :\n application declares die types it s gt>ing to put on die 
pasteboard, it gives the pasteboaid an owner. Tliis is liecause it 
may not want to put die actual data on die pasteteard immediately. 
Say an appliaition want^ to put an image on die pastelxiard in 
multiple fomiaLs. It’s radier wasteful to pul all intiige types on the 
pasteboard immediately. In these cases, the source application may 
put a premise on the pa.stelx>ard. When and if another application 
requests the data from the pasteboard, die piLstetxxard will ask the 
owner to provide the data and fulTill the promise. Since we are 
providing all die data immediately, we do not liave to set die 
owner. 

Reading Data from the Pasteboard 

Just as die sending application may put multiple type.s of data 
on the pasteboard, the receiving application may accept multiple 
types. Again, die appliendon specifies which types it can support, 
and then, if the pastelioard contains any of dio.se types, it retrieves 
the data. The ctxle to retrieve a string from the pasteboard looks 
like this: 

NSPaStaboard ^ paateboard = [NSPaataboard ^ 
generalPaateboard]: 

NSArray * types = [NSArray ^ 
arrayWitbObJect ;NSStrliigPbt>ardType] t 

NSString * bestType = [pasteboard 
availableTypeFromArray-types]: 

If {bestType 1= ail) 

( 

NSString * value = 

[pasteboard stringFQrTypeiNSStringPboardTypeJ : 

// Use pasted value 

I 

Again, this code u.ses the general pasteboard, The 
availableTypeFromArray: returns the liest type of all thase 
specified in the array or nil if none of the types are available. 
Finally, the stringForType: methexi retrieves die actmil string 
from the pasteboard 

Implementing Copy 

Anned with our neu^ knowledge of the pasteboard, we can 
now implejuejiL copy for oui WordView cusiom view. Since dtis 
view^ iLses styled text to draw the string using an attributed string, 
it can put bodi styled text and plain text on the pasteixjard. It's 
easy to get an R'lP representation of an attributed string, so we can 
use RTF as the styled text type. 

As a refresher, here is die drawRect: metliod dial creates an 
attributed string: 

- (vaid)drawWQrd 
( 

NSRect bounds = [self bounds]: 

bounds = NSInsetRect(bounds, 4,0, 4.0): 

NSFont * font = [NSFont sy3teiiLFontOfSize:50] : 

NSDictionary * attributes = 

[NS Dic tiona ry diction a ryWithObj e c t:f ont 

forKey iNSFontAttribttteNajne]: 

NSAttribuiedStrlna * string = 

f [NSAttributedString alloc] initWithStrlng:_word 

artributea:attributes ]; 
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NSSi^e strlngSize = [string siEe]; 

KSPoint point: 

// Center vertically 

point“ bounds.size.height/2 * stringSize.helght/l: 


We can now write a method that puts die word on tlie 
pa-steboard, in both rich text and plain text: 


// Align horiKonally 

if (_teztAHgiimeni = WordVlewCenterTextAJigrmieTit) 

point.X = bounds.size.wldth/2 ■ strlngSize.vldth/2; 

else if (_teztAligTiirient = WordVlewLeftTextAlignment) 
point,X ^ bounds.arigiii.xr 

else if (_textAlignment ^ WordViewtUghtTextAiigTiiEent) 
point= bounds,size,width ‘ strlngSize,width: 

[string drawAtPoint:point]; 


We are aeating an attributed string with a font sm of 50 
points, Since we can use the attributed string in our copy: 
method, we can re-use this code by extracting t into its own 
method. Extracting ccxle into a meth(x! is one of the refacttjring 
types that Xcode .supports, so let's use it to help us out. 

1b do this, you select the ctxle you want to extract, as sliown 
in Figure 5, and tlien chcx)se the Edit > Refactor,., menu. Xcocie 
tlien analyzes tlie code and jx^ps up a dialog box to name tills new 
metliod. Name it wordAsAttributedString, and then chose 
Preview followed by Apply. 
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- (TGid)ilr&w^rd 

( 

SSItecjt bounds = [soli fcoxuidsl; 
boimds = OSXiis^tEsotCbounds^ 4.0^ 4.0); 


RSFont * iont = (HSFotit »yrt«snFont0f Si3»:501 j 
BSOiotiomri * attrtSuit&s ^ 

41 otjjawirytit)ect: font 

jEorIC»y iJlsrQntAttnlrot*ll*Jhjp ] ; 
lfSAttrlbut«dStrln 9 * st.irlng « 

[[IfSAttriTJvtedString ullool 3.mtWitS,^tritig: - i i 


MSiM strlngSize ■ [string Biz*]; 

irSFOiTit point ; 

// Onter ’rertioilly 

point. y ±i booikAs. siso, height /2 - stringSize. hsight /2 j 

// Align horxisonnllj 

U C_t«*tAligjuo*ht == ^dTiewCeriterTesctfcligiwiont) 

point. X a hounds. siae. vldth/^ - stringSize. widtJi/2; 

els* -Lt ““ fftJrdTx#*t*ftT*ztAlj.gn»i'Rt3 

point. X « bon^B. Origin. X; 

If t..feeAlignment == ffordfievRi^tTe^ttAlignment) 
point,* & hounds.sise.n-dth - strtngSlzo.width; 

[string dr^wAtFolnt:point 1; 

Figure 5: Selection to extract 


- (void)wrlteToPasteboardI(NSPastebo^rd *)paEtEboard 

I 

NSArray * types ^ [NSArray arrayWithObjects: 

HSRTFPboardType. NSStriugPboardType» ”> 

nil]: 

[pasteboard declareTypee:types owner:nil]; 

[pasteboard EetString:_word forTypetNSStringPboardType]: 

NSAtiiributedString * attributed Word = [self 
wordAsAttributedStriJig]; 

NSRange fullRange = NSMakeRange[0, [attributedWord 
length]): 

NSData * rtfData ^ [attributedWord RTFFroEiiRaiige:fullHaiige "f 

dDtimiientAttributea:nill ; 

[pasteboard setData:rtfData forTypeiNSRTFPboardTypa]: 

I 

This ccxle Ls similar to the simple case we lotiked at alxwe for 
w'riting a plain text string. In this tuse, the pasteboard Ls being 
|Ta.ssed in. to make tills ay(k more generic. It is alsc^ declaring two 
types, an ITTF type and a plain text string tv^pe. Setting the string 
data is simpk enough, since we cm use the _word iastiince 
varkible. Setting tlie R1T data is a bit more involved because we 
have to specify tlie mnge of characters. We create a range that 
ena)mpasses the full string. And finally, it sets the RTF data using 
the setDataiforType: metliod. 

Ail we have lefi to do Is to aill this method from the copy: 
niethcxi: 

- (IBActicm)copy:(id)sender 

I 

NSPasteboard * pasteboard = [KSPasteboard “> 
generalPastaboard]: 

[self writeToPasteboard:pasteboard]; 

] 


With this ctxJe in place, we can now fin:illy test out copy Run 
tlie application and chose the Edit > Copy menu item. Now run 
TextEdit and chose Edit > Paste in a new^ dcxiinient. The TextEdit 
dcx'ument .should contain the word ""Cocar widi in same font and 
size that %w used in our application. a.s shcmm in Figure 6. 


Xcocie eremites the metlxxl and calls it w'here your .selection 
mis. I typicilly fix up the indentation and cfxling style a bit, but 
tliis refactoring tcx>l dexfs help automate aeating a new metbcxl 
from existing code. In the end, tills new method should look like 
tllLs: 

- (NSAttributedString ‘)wordA^AttrlbutedStrlng 

t 

NSPont * font = [NSFont systemFontOfSize:50]; 

NSDictionary * attributes ^ 

_ [NSDict ionar y dictidnaryWitbObject:font 

fQrKey:NSFdiitAttributeNBmel: 

NSAttributedStuing * string = 

[[NSAttributedStriDg alloc] initWithStriiig:juord 

attributes .'attributes] ■ 
retUTTi string: 

1 


® ^ 



If you try pasting in a plain text doaiment or an application 
like the TemiinaL then only the word “Cocoa"* is pasted, without the 
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torn style. This Is because our application put IxJth rich and plain 
text on the pasteboard. 

Implementing Paste 

With copy implemented, we now need to implement paste. 
In a similar fashion^ we are going to use a generic metliod to read 
from a pasteboard, as follows: 

- (BOOL)readFrcmiPast&ticiard: (KSPastiboard *)pasteboard 

NSArray * supportedTypes = 

[NSArray arrayWitIiObject;NSStiringFbo^rdTypeJ j 
NSStrin^ * bestType = 

[pasteboard availableType?romArray:supportedTypefi]; 
if CbestType = ail) 
retiirii iJO; 

NSStrlng ^ value ^ 

[pasteboard strlxigFgrTypeiNSStriagPbQardType]: 

NS Character Set * iijh it e space = 

[NSCbaratterSet whitespaceCharacterset]; 
value = [value st r in gBy T riinmingCharactersIiiSet: white space]; 
NSArray * words = 

[value 

contponentsSeparatedByCha.tactersInSet;whitespace]: 
if {[words ccruntl != 1) 
return NO; 

seif.word ^ value; 
return YES; 

1 

To simplify matters, we are only going to accept plain text 
type. Tills metliod returns a BOOL that returas YES if it did update 
tlie word from die pastelxxard, otherwise NO. Since our view Ls 
only supptxsed to show a single word, it also easur^e-s that there's 
only one word on t)ie ixLstelxiard. 

Tills ctKle retrieves a plain text .string from die pa^steboard, as 
previously demonstrated, returning NO if the plain text t>pe is not 
available. Next, we need to count the numlier of words in this 
string. First, we use the 

stringByTrimmlngCharactersInSet: method to remove 
leading and uniling wliitespace charaaei^J The whitespace 
chaiacter set includes the space and tab cliaracters. After removing 
any leading and trailing whitespace, we split the string into words 
by asing componentsSeparatedByCharactersInSetIf 
tlie nunilier of words is not rme, dien we abort and return NO. If 
diere is a single word, we ,set our word to this new woixl and return 
YES. 

To complete our paste implementation, we need to implement 
the paste: method as follows: 


’ (iBActioti) paste: (id) sender 

i 

NSPasteboard * pasteboard = [NSFasteboard 
generalPasteboard] : 

if C I [self readTraiii?astebaard: pasteboard]) 

NSBeepO; 

) 

Again, we use die general pastelx>ard. If reading from tiie 
pasteboard fails, xve lieep to let the user know something has gone 
wrong. 
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Implementing Cut 

Cut is simikir to a copy followed by a delete action, llius we 
could implement cut r as follows: 

- {IBAction}tut:[id]sender 
f 

[self copy:sender]: 
self.word - 

1 

Updating User Preferences 

WeVe now finished updating our Word View. Tfie applit:atiQn 
stores die user's favorite word in its preferences. As a final touch, 
wed like to update die user preferences when the user pastes in a 
new word. Since tlie view is supposed to be a generic word view, 
we don't w'ant to put tliis logic in the view, Tlius, the main window^ 
controller needs to watch for changes to the view's word and 
update die preletences. lliankfuliy, our view is fully key-value 
coding (KVC) compliant, so we can use key-value observing (KVO) 
to lie notified of changes to die word. At the end of the 
awakeFromNib mediod add diis bit of ccxlc: 

LwordView addObserveriself 

forKeyPath;@"word" 
options:0 

context:^WordChangedContext] 


[USUserDefaults utandardUserDefauIts]: 

[defaults setObj ect:,.wo rdVie^*word 

f 0 rKe y: Favo I i t eW 0 rd Key ]: 
_WQrd3jpd&tingFromV;lev = MO; 

] 

1 

Finally we need to update our notification method to use this 
new^ instance variable, as well: 

- (void)updatGFromDefauIts:[MSHotification *)notification 
I 

MSUserDefaults * defaults = 

[NSUaerDefaulta staudardtTserDefaults]; 

If (] _wardUpdatiiigFj:QinViGw) 

_WordView, word = [defaults 
objectForKeyiFavoriteWordKey]: 

NSData * colorData “ [defaults 
object ForKey;Ba ckgr ound ColorKey]; 

MSColor ^ color ™ 

[MSfeyedUnarchiver unarchiveObjectWithDataicolcirDataj : 
.woriiV-Sew-backgroundColor = color; 

WordVieT/rextAlignment alignment ■ 

[defaults integerForKeyrTextAligmeiitKey]: 
^wordView.textAlignment = alignment; 

I 

Tlie only modification from our previous versk^n is these two 
lines: 


In the observer metliod, we want to update tlie u.ser defairlt-s: 


(void)observeValueForKeyPath:(NSStrlng *)keyPath 
ofObject;[id)object 

change:(KSDidtionary *)change 
contextMvoid *)context 


if (context = ^WordCbangedContext) 

I 


I 


HSUsetDefaults ‘ defaults = 

[NSUserQefaults standardlfserDefaulta]; 
[defaults setObject:_wotdView.word 

forKeytFavoriteVJordKoy] : 


Unfortunately this code has a serious hug. 'fhe main window' 
controller is already olxserving changes to user defaults and updates 
the word view if it changes, llie code as it stands results in an 
infinite l<x)p. Upchiting the default value sets the word view Is w^ord, 
w'hich again triggers the key-value ol>ser\dng metliod. Tills in turn 
sets tile defitult again, ad infuiitum. 

1b Fix this, we don't w'ant to upcbite the word view' s word if 
the dehiult changed due to a KVO trigger. We use a new^ insumce 
variable, _wordUpdatingFroiiiView diat is set to YES during our 
KVO method: 

- (voidjobserveYalueForReyPath:[MSStting *)keyPath 
ofObject:(id)object 

change: [NSMrtionary ■*) change 
context:(void *)context 

I 

if [context = StWordChangedCowtexT) 

1 

^wordBpdatingFromView ^ YES: 

NSlIserDefaults * defaults = 


if (] war.iUpdatingi’tatiiView) 

wordView,word = [defaults 
ob j ectFo rKey :Favor it eWordKey]: 

This piotects from tlie infinite loop, only Lipcbiting tlie word 
view if it wasn’t initiated ftom the word view itself 

Conclusion 

In tills artiele, weVe learned aD ab(jut the liist responder, the 
responder chain, nihtai^et actions, and also tlie pastelxxtrd. And 
weVe put all of these concepts together so we could implement 
c'Ofiy paste, and citt. As usual, the full code is available on the 
Mac fech website. 
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ConceptDraw Office Role 
in Quality Improvement 

When planning for your next product rollout, there are a 
umber of well-known variables that impact how well a new 
roduct Is received. Superior product quality is a proven 
ontributor to market success as it has a positive impact 
n how customers perceive the value of the products they 
urchase. Exceptional quality has a great Impact on the user 
xperience and encourages word-of-mouth advertising for 
roduct offerings. 

tix Sigma Role in Quality 

ine way to measure quality, is to calculate the number of 
efects over a given sample size. A methodology that Is widely 
sed to reduce the number of defects, thereby improving 
nd maintaining quality, is Six Sigma. Six Sigma Is a quality 
focess that specifies the number of defects in a product 
annot exceed 3.4 defects per million. Reducing the number 
f defects to this level does not happen by chance or luck, and 
jquires proper planning and discipline to keep the number of 
efects to appropriate levels. 

here are two common methodologies in Six Sigma which are 
sed in different situations depending on if the process under 
3view currently exists, or is a new one being developed. 

»efine. Measure, Analyze, and Improve Control (DMAIC) is a 
iix Sigma method used for examining existing processes that 
ill to meet desired quality specifications. Define, Measure, 
malyze. Design and Verify (DMADV) is a Six Sigma method 
sed to ensure that proper levels of quality are built into the 
roduct and development processes from the very start. 

lany of our customers use CS Odessa’s ConceptDraw Office 
j assist in their Six Sigma implementation. ConceptDraw 
)ffice is a unique business software solution that combines 
usiness productivity methods and data visualization with 
roject management technologies. ConceptDraw Office 
lakes it a snap to plan, develop, manage, and document 
uality processes. 



ConceptDraw Office is comprised of ConceptDraw MIND MAP, 
PROJECT, and PRO—all packaged into one seamiesssoftware 
tool kit. 

ConceptDraw MINDMAP 

ConceptDraw MINDMAP is an excellent tool to enable the 
recording of observations and development of inclusive 
quality processes. If you have multiple processes to observe, 
ConceptDraw MINDMAP has the unique ability to capture all 
of those processes, each on with their own respective page, 
in a multi-page master mind map, Moving from observation 
to early process development is as easy as dragging-and- 
dropplng items or objects that can be used to structure a 
process and then immediately assign resources. 

ConceptDraw PROJECT 

With a single push of a button, all observations and task 
information are automatically moved over from ConceptDraw 
MINDMAP to ConceptDraw PROJECT. From a project 
vantage point It is easy to manage all the resources available 
to you and ensure proper management of all the processes 
put into place. 

From ConceptDraw PROJECT, a number of visual scoreboard 
project reports can be opened in ConceptDraw PRO, a 
professional business graphics tool. 

ConceptDraw PRO 

ConceptDraw PRO is a professional business graphics and 
drawing tool that is an integral part of ConceptDraw Office. 
ConceptDraw PRO is welt known for its ability to produce eye 
popping business graphics and flow charts. In professional 
formats. 

Plan, Do, Communicate 

ConceptDraw Office Is a proven and powerful software solution 
that can assist you in the common challenges you are faced 
with when working towards meeting quality measurement and 
process definition goals. 
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Recipes for using iaunchd for systems 
administration 


By Greg Neagle, MacEnterprise.org 



MacEnterprise.org 

Mac OS X enterprise deployment project 


Introduction 

A few months ago, we looked al how to run adniinisiraiive 
scripts - how a systems administrator could run a script at 
startup, or a schedule, at user login, and moiv. There are many 
niechanLsms to launch scripts at specific times and under 
specific conditions, but the one that came up over and over was 
Iaunchd. 

This shouldn’t be surprising. Apple introduced Iaunchd 
with the release of OS X 10.4 Hger, and their stated goal was 
to make Iaunchd replace most the other ways of launching 
processes on OS X. Specifically, Iaunchd was designed to take 
over tasks from cron, xinetd, mach^init, and init, and 
to largely replace the Stanuplteni mechanism. 

Recently on the MacEnteqmse mailing list there was a 
discussion about accomplishing a certain task with a login 
htK)k, There was a reply that if one could acccjmplish tlie task 
using a Iaunchd LaunchAgent, that would he preferred. Then 
the floodgates (Opened. A big discussion ensued alKJUl 
LiiunchAgenLs versus login and logout hooks, Iaunchd jobs as 
compared to cron jobs, and so on. It was quickly apparent that 
Iaunchd was still not completely understood or trusted by 
many Mac OS X systems administrators. More specifically, it 
became clear there is still a need Ibr concrete examples of how 
systems administrators can use Iaunchd to replace cither 
launching methods, like cron or a Startupliem, and to do 
things those launching mechanisms cannot. So in this column, 
1 will present some “Iaunchd recipes'" - ctxle snippets you can 
adapt to use for your own tasks. 

Recipe Ingredients 

Before we can look at some recipes, let's do a quick review 
of some of the ingredients we'll be working with. 

A key concept is that Iaunchd is just a mechanism to 
launch processes under certain conditions, and to optionally 
keep tliem running even if they unexpectedly e?dt. Launchd is 
not a scripting language. To do anything useful with launchd, 
you must have two ingredients: 


A launchd plist. lliis is a configuration file that tells 
launchd what to launch, and under which conditions. We’ll be 
looking at several example plists in this month's column. 

The actual executable task. Hiis can be a script, or a pre¬ 
compiled binary. This is what launchd runs for you when the 
c:ondition.s described in the launchd plist are met. 

In most of dtese recipes, 1 leave it to you to supply the 
script. The focus of this column is lum to get launchd to 
execute your script under the right conditions. 

If you compare launchd to some of the more traditional 
methods of running tasks, youll see the cuher methods support 
a more limited set of conditions. For example, the Startupitem 
mechanism can run a ta.sk only at startup, cron can run a task 
only at a certain time, periodic runs tasks only at certain 
intervals, xinetd t'an run a task only when a connection is 
attempted on a certain network |>ort, Ixigin items are executed 
when a user logs in. Launchd can run tasks based on all of 
these conditions, and more. 

Launchd plists typically go in one of three locations: 
/Library/LaunchDaemons, /Library/LaunchAgents, 
and ^/Library/LaunchAgents. fThere are two more 
directories containing launchd plists 
/System/Library/LaunchAgents and 

/System/Library/LaunchDaemona, but these are 
reserved for use by Apple.) The launchd plists in 
/Library/LaunchDaemons are loaded at startup (this does 
not necessarily mean that the jobs themselves are nm at startup, 
though) and die plists in die two LaunchAgents directories 
are kjaded at user login (or other login-related contexts). 

Two more things to know alxjui launchd plists: they 
must Ixf owned by root, and have permissions 0644. If 
launchd doesn't like the ownership or permissions of a plist, 
it will refuse to load it. 

Now that we've reviewed the ingredients - on to the 
recipes! 
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Recipe 1: Run a script at startup 

This is the simplest recipe. We have a script we^d like to 
run at startup. 

Create a plist in /Library/LaurLchDaemons with 
contents similar to these: 

version=^' 1 , 0 *^ eiicoditig="UTF ■ ?> 

<!D0CTYPE plist PUBLIC //Apple Computer//DTD PLIST 
1.0//EN" 

"http://wwv-apple,com/DTDs/PropertyList-l.0,dtd”> 
(plist veraloTi""! . 0" > 

<dict> 

<key>Label</key> 

<string>org-royorg, startup*scriptnanie</strlTig> 
<key>PrograinArguments</key> 

(array) 

(string)/path/to/script(/string) 

<3tring>-argument</string) 

(/array) 

<key>RuiiAtLpad(/key> 

<trtie/> 

(/diet) 

(/plist) 

You can name the plist anything you'd like ending in 
“.plist/ but the normal convention is to use the same name 
as the Label, so this plist would be named 
“org.myorg*startiip.scriptname*plistL This 
laiinchd plist defines only three keys: Label, 
FtogramArgunients, and Run At Load. Label defines a 
unique name for this la undid job. ProgramArguments 
contains the path to the command or script, plus any 
arguments, options, or switches to he passed to the 
command. If you w^anted to remove the Apple Type Sendees 
databases at each startup, this command: 

atsutil databases -ramove 


would become this in a launchd pliHC: 

<key)ProgtatnArgiim^Tits< /key) 

(array) 

<strlng>/usr/bin/atsutiK/string) 
(strlng)databaEeE(/string) 

(Etring)’remoyeC/string) 

(/array) 


Note that this doesn^t wx)rk; 

(key> ProgramArgumenta </key) 

(array) 

(string)/usr/bin/atsuTil databases -rejiiove(/string) 
(/array) 

The script or command itself and each argument or flag 
must be in a separate <string> element. 

The RunAtLoad key simply tells launchd to run the 
job as soon as it loads this plist, Since a plist in 
/Library/LaunchDaemons is loaded at startup, the job 
is run at startup. 


Recipe Variation: Run once at startup, 
but never again 

A common systems administration need is for “run- 
once’' startup scripts - typically these do .some sort of 
configuration and so only need to run once. Unfortunately, 
launchd plists provide no explicit support for this sort of 
thing. (The man page for launchd. plist mentions a 
“LaunchOnlyOnce" key - hut this causes a f{)b to be 
launched only once per boot.) Your options for a job that 
runs only once are: 

Have the script delete the launchd plist after it runs* 
On the next boot, since the launchd plist no longer exists, 
the job will not be run again. 

Have the script execute 

launchctl unload -w 

/Library/LaunchDaemons/myjobname * plist 

as the last thing it does. This adds the Disabled key to 
the launchd plist and sets its value to True, so the job 
won’t load on future reboots unless you remove the 
Disabled key or set it to False. You must call 
launchctl unload as the last thing the script does, 
though, because a side effect of unloading the plist is that 
the script will be killed as well. 

Alternately, you could use a tool like FlistBuddy to WTite 
the Disabled key to the pHst; this would avoid the issue of 
killing the process at the same time. Here's a Perl snippet, 
stolen from /usr/libexec/configureLocalKDC: 

lEy $rerun_plist = 

* /System/Library/LauticbDaetnotis/cotn. apple. configureLocalKDC 

* plist': 

ehottip (my $statuE = qx 1/usr/llbexec/PlistEuddy '^Print 

‘Disabled" Srerun.pllstf): 

if ($status rie ^trueD I 

ByEtem Viisr/llbexec/PlistBuddy' . '-c', 'Add 
:Dlsabled bool True'. $rertii3_pllst: 

1 

Have the script check for something else to see if it has 
already run. The script will still run at every startup, but if it 
finds the existence of a certain file or directory, it exits 
without doing anything else. An example of something 
using this strategy is the Setup Assistant that runs w^hen you 
first install OS X, or when you first startup a new Mac. If the 
file /var/db/* AppleSetupDone doesn't exist, the Setup 
Assistant runs on boot. When the Setup Assistant exits, it 
creates the *AppleSetupDone file, stopping the Setup 
Assistant from running on future boots. An advantage of ihLs 
approach is that if you ever need to re-run the script or 
application for any reason, you can remove the flag file to 
do so. 
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Recipe 2: Run a script 
on a repeating schedule 

Cron and periodic are two traditional to ain jobs 
on repeating schedules. Periodic is typically used to run a 
job on a daily, weekly, or monthly schedule. Cron can run a 
job on virtually any schedule you can imagine - once a minute; 
every Friday at 3;45pm; every two hours between 8AM and 
6 pm, Monday through Friday, and more. Cron and periodic 
are still around in OS X Leopard (and work fine), but launchd 
can replace most of what they do. 

Here’s an example of a launchd plist that runs a script 
every day at 5:15 AM: 

<7xml version="l.D" encoding^"UTF-8"7> 

<!DOCT¥PE plist PtHLIC ‘'■//Apple Computer//DTD PLIST 
1.0//EN" 

"littp: / /WWW.apple. 

com/DTDs/PtopertyLiSt -1.0. dtd" > 

<piist versloii=''i.0''> 

<dict> 

<key>Label</l5ey> 

< St ring>ci rg .myor g. daily. radinind< / string) 

(key > P ro g r amA r gument s ( / key ) 

<array> 

(string) / usr / local / radmind/ run_radiiiii];d< / string> 
</array> 

(key> S tart Calend a rlnt e rva K/key) 

(diet) 

(key>Hour</key> 

(integer>5</integer) 

(key>Minute</key> 

(ilitegeE)15C/integer) 


(/diet) 

(/diet) 

(/plist) 

This pUsi lias no RunAtLoad key, since we don’t want the 
script to run at startup. Instead, it has a 
StartCalendarInterval key, which describes the 
repeating schedule for the script. StartCalendarInterval is either 
a single dictionary or an array of dictionaries. Each dictionary 
can have any combination of the keys Hour, Minute, Day, 
Weekday, and Month. In this example, tlie job will run 
whenever the hour is 5 and the minute is 15. Since the keys 
Day, Weekday, and Month aren't specified, the job will run 
every day of every month, llie only key tliat might be non- 
obvious is Weekday, lliis takes an integer from 0 to 7, and Ixjth 
0 and 7 correspond to Sunday. 

IFs possible to replicate almost ail of the scheduling 
possibilities that cron offers, though the launchd plist version 
will be much more verbose. You can specify multiple calendar 
intetv^aLs by setting the StartCalendarInterval value to 
an army of dictionaries, like this; 

(key )StartCaleuda rinter val < /key) 

(array) 

(diet) 

<k6y>Hour</key> 

(integer)3</integer) 

(key>Hinute(/key) 

(Integer)15(/integer) 

(/diet) 

(diet) 

(key>Hour</key> 

<integer)10</integer) 
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<key >Minut e </k ey > 

(integer>3 0 </ lntegei:> 

</dlct> 

<y arrayk 

This St art Calendar Interval would cause the job to 
be run at 3d 5 AM and 10^30 AM. 

The other launchd key that is of interest in scheduling 
repeating jobs is Start Interval. Tlie value for this key is 
an integer representing die number of seconds between job 
runs. Ilie following example causes the job to lie run e\’ery five 
minutes: 

<key>StartInterval</key> 

<integer>300</integer> 

Variation: Run a script at startup and on a 
schedule 

If you have a script you'd like to run at startup and also on 
a regular schedule - for example, a script that uploads asset 
information about the current machine - you can add both a 
StartCalendarInterval and a RunAtLoad key to the 
launchd plist: 

<?xml version^" 1*0’’ encoding="t]TF-B"?> 

<|D0CTyFE plist PUBLIC //Apple Computer//BTD PLIST 
1.0//EN" 

"http; / /ww. apple, 

com/DTDs/PropertyList-1,0.dtd"> 


<plist versioii”*'!.0"> 

<ksy>Labe1</key> 

<st ring>org,myo rg.assetinfoupIoad</string) 

<key > Prog ramArguMGiits</key) 

<atray> 

<string>/usr/local/scripts/asset_info_update</string) 
</array) 

<key> StartCalendarItitGrval< / key) 

<dlct> 

<key>EDiir</key> 

<iiiteger>l2</integer) 

<key>Miinite</ key > 

<ijiteger) 15 (/ integer) 

</dict> 

<key >RunAt L o a d </key > 

<true/> 

</dict> 

</pList> 


Recipe 3: Run a script on 
filesystem change 

Launchd can am a job when a file or directory changes. 
There are two relevant keys: WatchPaths, which takes an 
arniy of strings, each of w^hich is a path to a file or a directory, 
and QueueLirectDries, wiiich also takes an array of strings, 
but these must point to directories only. 

When using WatchPaths, any change to the path triggers 
the job. In the case of a file, touching the file or changing its 
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contemn will caojie the launchd job to mn. With directories, 
adding or removing files will suirt the job* 

QueueDi rectories are monitored a bit diiTerently, If a 
QneueDirectory is not empty, your job will be started If 
your job quits and the directory is still not empty, your job will 
be started again* The idea here is a script or program that is 
started when items appear in a directoiy^ processes each erne, 
and removes each item from the directory^ as it goes* This acts 
much like a mail queue or print queue. Prior to launchd, 
systems administrators would often implement a cron job that 
ran every minute or so and checked the directory to see if 
anything had been added* With launchd, you can just let 
launchd notify you if something appears in the directory* 

A WatchPaths example: 

< 7 xTnl version-" encodiTig-'’inT £"?> 

<!D0CTYPE plist PUBLIC //Apple//LTD FUST l-OZ/EN*' 

''bttp: / / WWW. apple* com/DTDs/FropertyList-1 * 0* dtd''> 

<pllst version^"l.O'O 
<dict> 

<key>Label</key> 

<striTig>org. tnyo rg * sudoers • checK / str ing> 
<kGy>PtogtaiiLArgUDients</key> 

<array> 

<String>/usr/bin/logger</string) 

Cstring>/etc/sudoers was changedt</sTring> 

</array> 

<key>WatchPathB</key> 

<array> 

<string>/etc/sudoers</string> 

</array) 

</dict> 

</plist> 


This launchd job watches the /etc/sudoers file and 
w^rites a message to tlie log if it changes. If you w^ere really 
interested in being notifiec] when die sudoers file changed, 
you'd probably w^ant to use a mechanism that sent email or 
posted data to a database or via a web CGI* 

Recipe 4: Allow a non-admin to 
run a script as root 

Sometimes there is a need to allows a standard user to run 
a command or script that only works properly when run as 
root* Building on Recipe 3t we can use launchd to enal>le this. 
By default, jobs run by launchd LaunchDaemons run as root* 
(LaunchAgents are a different matter ) If w^e set up launchd to 
run our script when a file changes, and that file is changeable 
by a standard user, then the user can run the script by changing 
the file. 

I'his recipe requires some additional ingredients. We need 
a file that the user can change but nor accidentally remove, 
since launchd’s behavior is - shall we say - inconsistent if the 
WatchPath disappears. One way to do tliis is to create a 
director)^ that is readable by everyf>ne, but writeable only by 
root: 

mkdir /Library/Kanageinent /T 11 ggers 

audo chown raot /Library/Manageffient/TriggerB 

sudo chmod 755 /Llbrary/Managament/Triggsra 
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Within this directory^ create a file to use as the trigger, bui 
make it world-wri tables 

sudo touch /Library/Management/Triggers/softwareupdate 
sudo chmod 666 /Librairy/Management/Triggej:s/softwareupdate 

Now any user may change the softwareupdate file, but 
only root can remove it. Our launchd plist can now specify 
our trigger file as an item in the WatchPaths array: 

C?xinl VErsion-n,0*' pncoditig="UTF-8’*7> 

<!D0CTYPE plist PUBLIC /Apple//DTD PLIST 1.0//EN'^ 

"http: / /ww,apple .com/DTLs/PropertyLiat-l. 0.dtd"> 

<piist version="K0”> 

<dict> 

<key>Label</key> 

<string>org.myorg.softwareupdate</strlng> 
<key>ProgramArgun]eiits</key> 

<array) 

<strlng>/uEr/3hiri/softwareupdate</ string) 

(string)'-install</string) 

(string)--all</string) 

(/array) 

<key)WatcihPaths(/key> 

(array) 

(string)/Library/Management/Triggers/softwareupdate 
(/string) 

(/array) 

(/diet) 

(/plist) 


This launchd plist watches the trigger file. When it changes, 
it runs: 

Softvarenpdate --install --all 

We need one more ingredient - a way for the user to easily 
modify rhe file. You could tell the user to open a Terminal 
window and type “touch 

/Library/Management / Triggers / sof twareupdate'’, 
but theyil look at you like you Ye insane. So let’s do something 
a little more “Mac-like”, Tliis could simply be an AppleScript 
applet that touches die file: 

display dialog ’’Do yon want to run Software tfpdate and 
install all available updates?" buttons ("Mo". "Yes"] 
default button "Yes" 

if button returned of result ie "Yes" then 
do shell suript "touch 
/Library/Management/Triggers/softwareupdate" 
end if 

When compiled and run the AppleScript presents the 
dialog in Figure 1. 
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Do you want to run Software Update and instaH all 
available updates? 


( No ^ V es 

Figure 1 - A GUI to trigger softwareupdate as root 

If the user clicks Yes, the AppleScript touches our trigger 
file, launchd notices the change, and runs softwareupdate 
as root. 

This example would need a lot more lleshing out before 
rd consider deploying it to real users. Instead of directly calling 
softwareupdate, youVI probably want to write a script that 
called softwareupdate, provided progress feedback to the 
user, and handled the case where a restart is needed after 
updates are installed. The launchd job could then call that 
script. Still, the basic idea is there: a method to allow a non- 
privileged user to lun a proce.ss as root. 

Hungry for more recipes? 

There are at least a few more things systems administrators 
might %vant to do with launchd, Some examples: 

Kun a scrip! (or an application) wdien any user logs in. 

Run a script wlien the login window loads. 

Run a script when a volume is mounted. 

1 hope to have some recipes for these and more, and 
maybe cover some new Snow Leopard features in a future 
Machnterprise column. LJntil then, you can find more info here: 

"Cietling Started wath launchd” “ 
http://developer.apple.com/macosx/launchd. html 

"Creating launchd daemons and agents” “ 
http://developerapple.com/ documentation/ MacOSX/Conceptu 
al/BPSystemStartup/Articles/LaunchOnDemandDaemons. html 
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Synchronize all your iTunes libraries into perfect harmony 
across multiple computers - everywhere you are! Easily 
access and merge your music and video files with another 
SuperSync library, computer, hard drive, 
network volume or iPod. 

www.supersync.com 


"Launchd in depth" - 

http://wvAv.afp548 .com/article.php?story=2(X)5062(D0715582 
93 (This one is a few^ yeans old; w ritien wlien Tiger wus new 
- but has a good example of WatchPaths and a quick 
mircKiuction to launchctl.) 

And of course, read the man pages for launchd, 
launchd.plist,and launchctl! 
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Extending the Casper Suite 
with Dummy Packages 

Adding custom management hooks 


by Miles A. Leacy IV 


Introduction 

Tlie Casper Suite by JAMF Software provides a robust 
management framewcxk for automating s\'stem administration 
tasks. Through Smart Ct^mputer Groups, imnagement policies 
can assigned to miichines that fit certain criteria such as 
computer name, IP address range and installed software 
packages, to name a few. In order to meet tlie challenges and 
demands of administering a set of Macs, system administn%tors 
will, on occasion, find tliat tliey would like to 4issign policies to 
or create Smart Computer Groups based on criteria that are not 
built in to the Casper Suite. 

The Casper Suite's abilities to am shell scripts and inick 
installed software packages on client Macs allow us to 
functionally extend our ability^ to create Smart Ckimputer Groups 
to include nearly any criteria the system administrator requires. 
By using a shell script, we t-an check for desired criteria, and if 
found, cause a ^'dummy" package to lie iasUilled. We can tlien 
use the receipt from this package as criteria for a Smart Computer 
Group. 

For the example in this article, we will assume that we would 
like to put all Macs that have pending firmware updates into a 
Smart Computer Group called Firmware Updates 
Available. A system administrator could mn a report that lists 
the memlx^rs of tliis Sman Computer Group. This repon can 
serve as a list of Macs that a technician will need to visit to 
perfonn the updates since fimiw^are ujxlates are one of die few 
administrative items that cannot be automated. 

Components 

There are five components to tliis teclmique; a script to 
check for desired criteria and trigger a policy to install the dummy 
package when the cTiteria are met, a policy to run the script, a 
cusiom*triggered qxilicy to install the dummy package, the 
dummy package itself, and a Smart Computer Group consisting 
of cc;mpuiers wixh a rec'eipt for the dummy package. 


Script 

The first item we need is the script. Tliis script will check for 
the desired oiteria, in this case, whetlier a Mac has available 
firmware updates. If the criteria are found, the script w'ill trigger 
a policy using the custom trigger 
firmwareUpdatesAvailable. If the criteria are found, the 
script will delete the receipt for a package called 
flrmwareUpdateaAvailable.pkg. This structure wall allow 
tlie script to act as a toggle, adding or removing tlie package 
receipt depending on whether the designated criteria are found. 
This script uses the jamf comniiind line tool present on all Macs 
managed by the Casper Suite. For our example, we will use the 
script Ixdow: 

/bin/bash 

header begins 

# filenause, sci:_sys_findFiirTnwai:etJpdate5. bash 

# 

# This script is provided "as Is". 

# The author offers no warranty or guarantee of any kind, 

# Use of this script is at your own risk. 

# The author takes no responsibility for loss of use. 

# loss of data* or any other negative effects. 

s 

# Test thoroughly in a lab enviroiunent 

# before use on production systems. 

# 

# This script checks for available firmware updates. If 
found, 

# a policy to install a dummy package is triggered, 

# 

imHf HEADER ENDS ### 

# store the number of available firmware updates 
in the variable Sfwupdate 

fwupdat6='Bo£twarfiLLpdate -1 | grep. -c Firmware' 

if if there are firmware updates available, 

if issue the custom trigger '^firmwareUpdatesAvailable" 

# if no firmware updates are available, 

# delete the receipt for fircnwareUpdatesAvailable,pkg 
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if [ $fwupdate -gt 0 ] 
then 

jamf policy ■trigger flrmwareUpdatesAvaliable 
else 

m -R /Library/Receipts/firinwaret]pdatesAvailablE.pkg 
nil -R /Library/ApplicatlonV 

Support/JAMF/Receipts/firmwareUpdatesAvailable.pkg 
fi 

exi t 0 


Once you have saved your script, set its permissions to allow 
execution by typing the following command in lerminal.app 

(adding the executable permission to all): 

chmod a+x /path/to/sct_sys_findFirtn¥are[Jpdates*bash 

You W'ill tlien need to add the script to your JSS using the 
Casper Adtnin application. If you are unfamiliar with this process 
you may review the Casper Suite Documentation (referenced at 
the end of this article). 

Tills script is specific to our example, but by altering the if 
statement and supplying any supporting variables, you can check 
for any criteria that yon can lind with a script. When wmting your 
owm scripts for dummy packages, be sure dvat your trigger 
matches the custom trigger used in the p<;licy that installs your 
dummy package (discussed bekw), and that the rm commands 
matches the receipts for your dummy package. Receipts for 
Apple .pkg format package.5 are stored at 
/Llbrary/Receipts/packageName.pkg- The Casper Suite 
stores receipts at /Library/Application 
Support/JAMF/Recelpts/packageName, pkg. and 
/Library/AppllcationSupport/JAMF/Receipts/packa 
geName, dug for Apple .pkg format packages and .dmg format 
packages built by Composer, the packaging application 
component of the Qisper Suite, respectively. 

Criteria-Checking Policy 

This policy^ should run on all Macs that you would like to 
check for the desired criteria and will nin the script we discussed 
above as a ‘"before” script. If youte familiar with adding scripts to 
a policy in the Casper Suite, you may want to skip to the next 
section. 

Log in to you're the web interfac'e on your JAMF Sofiw^are 
Server (JSS), and create a new^ policy by clicking the 
Management tab, then Policies, and Create New Policy... 
In die policy editor's General tab, give your policy an 
appropriate name, and a category if you wish. Categories are 
created in the Casper Admin application or through die Casper 
Admin link in the JSS' Admin tab and c^an be invaluable for 
keeping your list of policies organized and readable. For details 
and instnictions, see the Casper Suite Documentation referenced 
at die end of diis article. The criteria-checking policy's 
Triggered By; event wIU depend on your needs, but for this 
example, we'll choose startup. Selecting Ongoing in the 
Execution Frequency; held will ensure that this poliq^ runs 
each time the target Macs are booted. Figure 1 illastrates hcw^ the 
General tab should Icxik when we’re done configuring it. 
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Figure 1. Criteria-Checking Policy General Tab 


Once the General tab is configured, w'^e'U click the Scope 
tab. Don’t click the Save Policy button yet. Doing so will exit 
the policy editor. The changes we make in each tab w^ill be saved 
until we exit the policy editor allowing us to navigate through the 
tabs freely until w^efe certain that the policy is configured as we 
need it to be. In the Scope tab, we'll select die radio button next 
to Assign to All Computers. TTiis w^ill ensure that this 
policy will be mn on all Macs diat are managed by die Casper 
Suite. 

Next, we’ll select the Scripts tab in die poUcy editor. In 
die Scripts tab, w'e will add our script to die policy. Tlie script 
were using in diis example is called 
scr_sys_findFirmwarGUpdates .bash. Click the Add 
Script link, then chcjose Run Before under the 
scr_sys_findFirmwarGUpdatGs ,bash enUy^ and finally, 
click the Add Script (s) button. 
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Figure 2. Criteria-Checking Policy Scripts Tab 


The last item we’ll add to this poIicy^ is the Update Inventor}' 
action. Select the Advanced tab hi the policy^ editor, then click the 
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checkbox next to Update Inventory, then click the Save 
Policy button. Dpdating inventor)^ is very important for our 
purposes, l^ecause until inventory^ data Is updated, Macs with the 
desired criteria will fail to appear in the proper Smart Computer 
Cffoup, Once you have saved the policy; you should see it listed 
along with any other policies already configured on your JSS. If 
you click the Show Plan link next to the new policy, the plan 
should Icx)k like Figure 3^ 
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Figure 3. Criteria-Checking Policy Plan 


The Dummy Package 

The dummy package is the core of rliis teclinique. It is 
simply a package that does not contain any software to be 
installed. You can use Composer, die packaging tool provided 
widi tlie Casper Suite, or your favorite package editing application 
to create this package. The only item of importance in this 
package is its name. You should choose a name that is descriptive 
of what you are using the package to identify; in this case, we wiH 
use the name flrmwareUpdatesAvailable.pkg, Once 
created, the package is added to the JSS using Casper Admin. 

If you would like to be able lo use the indexing feature in 
Casper Admin with your dummy package in order to allow the 
Casper Suite to uninstall the dummy package, you w^ill need to 
have at least one file in your package. 
/Library/DuramyPackages/packageName,txt is 

suggested, but any convention tliat makes sense to you will do. 

If you are unfamiliar with package creation, adding packages 
to the JSS or package indexing, you may review the Casper Suite 
Documentation (referenced at the end of this ankle). 

Custom-Triggered Policy 

In the script discussed alxive, we tisecl die command jamf 
policy -trigger flmwareUpdates Avail able. This tells 
the j amf command line t(X)l on tlie client Mac to consult the JSS 
and execute any policies that are scoped to diis Mac and triggered 
by the aistom trigger firmwareUpdatesAvailable. Now 
well create die policy diat is triggered by this custom trigger and 



Futur« Media Concapti 


Training a New Generation of Digital Artists 


www.FMCtraining.com | 877.362.8724 

New York • Boston • Philadelphia - Washington DC-Orlando ■ Chicago & Midwest^pubaijss 




























VEGBTAH)ANBCrWlEn.Yuti 
me a wami bam wJid 
rrv^ heoi) kind at (Kiiil 

iKKi spoRtj ot tialriKl cit n&nttJd 
sttoe^. Wdiild tove to civcii m^r 
l'uimrrHi!!i «rj*ww 

tAWN CARE? My IwiSliHJid got la^y 
aiHl litrtfd yu4J In menv mir litwn 
Insit^nrl ytm lanuii^pfKi i^iy a rout: 
ifiRlHajes in way!? | haw newr irTiarg 
tficd C>3irld hpot pnincHirici! yynr 
tral Juiicth? narw but kiokod iMify ssmiual I ii^ 
blac BfioQS on w.'tQdfl 


QP YOU Rg SPOCK to rny 
Capta>ei Kirk; Love ycm in those 
vemty-st7e<t feans? LeT’» watch 
OfHTihftxjisbief Cultitw bant 


GORGEOUS, WITTY. SORN TO 
leaeu kmi tlieatAf, ilancie. Qtill, 
viratiTt t:nriv£irN»timi If yon te iHll 

IMMT iiUfJkuf, IjiiynuiiHy 
stfcufe, enjoys parT|;^ 
iravoiiriQ, 
plf'^ 


ARE YOU STIMULATED BY 
Htlel»nl«ric», ftninof^ AiimotlVfi SWE 
wsm uood loti«iii!4 SWM ut SHM 
lor rofnanttc adwnturoti, possible 
lono ttwm Essflfinalti t»nhO‘#ty. pas- 

Ettof], kifKlnosiH. iortsujTillly, kntat^oiy. 
OfKprt iiwkl ffTi/41 

ATTRACTIVE TAU {5 ir), wlantluf 
DPWf , 4B. eriK)tiiwij|liy anU pliy^l 
yllitui nfipciiMnca nitd 
TlLiftnL kwtfkji 


NOT SO DESPERATEIY MK,4Uiig 
om vniflfl, ^iJiy Ivjy 

1301 jTt aitd apHik Mi? ;»:l open tu 
possibilities iinct mvenou& tor miw 
life ojpenorK”v utipS-T 

SWlNGtNG SANTA, innety man 
wiKi only wijiks li wetfkJi a yoar 
^Hiking vWKRun with lull lima 
onifilijyriMini with bart6lit$ kJoJttnflilo SIOESH' 
grtiw old with than who sbakbs fiko ' stde^tb 
it bciwf lull Oil (Stiy.»I 


E. I did not 
iwdtl r«y hay. 
lautliut I wnofcf 
Did f read 


bPHONE PLAYING 
Filltivllk' ronemty 
m ’rtiasn 

VE Mn IN MADISON, 
r Would hlw to lalk 

.! 

Prom WCW. Exolionged 
«a at cape match It was pure 
Waald love it) goi ynu Jn a 
f hiwr 

SEAimi tJL AND SEVENTEEN I 
itlel volt Id itiLvM&trp Ybii.ywro op a 
i^ic wu»fltwioano:eifte ^-xtridife.it 
(slkhttm- 

EVi l ATING DUUDHA SWORIL 
'LAV i.-Wly fiii tO!Ha«bHT‘ 


TWINS WHO SAW TWINS. Ut. \ 
handstimif uuys m suspataders. 
ir>0 Mattose Vbtt two foxy lai]i| 
lidtittiKj ovor utfii plhco nl gk?ri| 
do you koy ol os riuik( 

good JooKmg ijmiploiiV Twm N 
CoU riHf Call me 1^4747 

DUGOUT firecracker. 'tUi 
wore hleanltig up ft beer that you 
jifwHet! Oil yiRir wtirte I shirt and 
ttirew a wimUtoy boltio at tho 
uniptn^. Mua&t nvioi you dikJ make 
(ilHtpreri. itsSRI 

DAVID, YOU'RE GORGEOUS, 
luhny mid brUttaoi I idoii'i detirCrvo 
you but o qieI can riieihu 

sv from down aoum. skV 

wllli MH ai FiTtnliyii t lr^4, m^t^tl 
yrVi.^jti tlio BtMjt Waiinaditi;?;. afli-’i 
wodf,;^tettiTKjY piiit ai.Ki:fiirnrrK; 
yptjj fiLlmtin r. ^i-'' i tiy n|] fi?7 

A$sy LATINA VUiirt -.iyl3|L’lr»i^. 


IE: LONELY SWEDISH LINGERIE MODEC 
and gourmet cook. You; slightly overweight 
and without ambition. Must be into computers, 
role-playing games and air hockey. ^5988 


cwufwelofiF 
wickad sonso ot liyriKir, and ^ woirp 
vinw III lile Inrjknig for Itko mmdud 
p&rHUi». Agt^ nol iinpottnitt 

TREE HUGGER. MID fiO S, lighl 
imiokfit, tail Like e'^ey livirig, tropics 
itiid I'lTJ twiKily SiMfklno cofUiidiw- 
altt, sejrFii ht cufi^anjon wJiii ji clue 
MiJtii tow fkigw and *09133 

ARE YOU HONLST. 

lfUt'C£JS5]tu1,‘ kJUillilllllty/UJvEijro' 

■ Vi'oriil itflvtitiriL LuHuieil*. life’;' 
ftiyft |Il pbyiifl, ridypiiuimuK, [,vin. 

hutiyif»vf(r, r^*«liid^ir?vjrr(| ■ ■ 
tthd boE^ii.jt';] ,10 nricf.:'*«;Kil^{:t‘(iU 


iiy cuta, pnliUi. 
DWF, 46. kjtia bruwfi liaiijluizfll 
oyws, U’ 110. uylUKrp pt^rsimfllity 
M?eks OWN. imp smoker, til, 
L'OiiPQi? urAHuit^l Celt fin?, let'ts uee 
il ihift ulkitntsiry \u ricjhn wGUOi 


WM. 85, RECENTLY WtdOWED, 
jeklng T^t ^ hotlto Ibr’Tuh' Gdll 
I'm Ifni waiting «ny j^lhQfri 
'iTTi^oiHhmy will. nfiVftr' 

OAitflOMEO. You s*r<rnaded;the 
cud oJIie Qi me old people hdr^ 
Yiip wifrei a tenible' 
irAniJdutiP unattractive, but 
iLir he^rJ ia cibvk>i)8iy piiine ijofa, 
My:vi5'idn«pyld tie fjedsci for ydu 
fi'mf " 

MONKEYTBAtNER. Ssftktng 
vwwTwn rq.tfitln mv thi^tilfay. 
Strtqusily,’ hii ndfne l^'MurphV ond' 
he iia’h 5 yaar'nfEl chitrifvthiep- Hii:-' 
ilki^^pcip'ians atwi fiice:ptFMpte 

Plus, I wiii( hflve i«x 

0 79V4 

StNGLE MAN &tiytv rnsit Keekifip 
uniyte kff rolotipfiship i 

eiijny diilinq and rti 
phrt. ii:! tfi worntiM ihpt \ litn 

Wfiidti clianoe to dal* some 

;jir 





aWF. STRAWatRRY CURLS 




wdij r- 
(On 


f 

T 

lib 

iitg . 
tmA* 
dh^ 

^1 la 
c^l mij 

MANYWONl 
rriy Jile bul na i 
wpncisdul wrtnrijliT- t, 
srhfliti„,pr\)ri>sftH3rtai. t+tu- 

h U3U sihok^ri Lcye of nshi, 

urevcwhi Inirnor wfiTTj? 

RECeNTi.Y PAROLEO.lPdkIng far 
3 lady wfto will keep mo 

^rni riqrrChY- MpiJt bu inhr 




We're Easier. 

In fact, REALbasic is the easiest, fastest way to create software for Mac OS X, Windows 
and Linux. 

Why use REALbasic? Use REALbasic to create software that solves a problem, automates 
a task, or unleashes your creativity. Use REALbasic to create software for your own 
use, to share with your friends and family, or even to start your own software empire. 

With REALbasic, simply drag-and-drop to build your interface, then add code that makes 
your interface work. REALbasic has online help, tips and auto-complete to guide you as 
you go. And if you do need help, our online community of thousands of users is here to 
answer your questions, 24x7, 

You start with an idea, the rest is easy. With REALbasic. 




For a limited time, getting REALbasic is easier too. 

Get 15% off when you buy a new REALbasic license. 

To get the discount, go to www.realsoftware.com/mactech 












will install the dummy package. If you are familiar with creating 
custom-triggered policies, you may want to skip this section. 

As before, well create a new policy. Click Management, 
then Polices, then Create New Policy,., in the General 
tab, we'll give the policy a descriptive name, select other 
(Manually specify the run at action in this 
field) from tlie Triggered By: menu. In die text field 
next to the Triggered By: menu, type tlie custom trigger 
(firmwareUpdatesAvailable, for our example). 


ManAg«fn«it 


Logjs 


Admin 


Plan for Policy Dummy Receipt Install firmwareUpdates Available 


Tliis policy 1$ set to Ongoing 
’Tttte policy Is triggered by other 
This policy is assigned to all computers 
Install firrmwartUpdatesAvariable^^kg 
Run Recon 



Figure 4. Custom-Triggered Policy General Tab 


In die Scope tab, well select Assign to All 
Computers agaia 

Next, we1! select the Packages tab, and click the Add 
Package link. This will bring us to the package seleaion page 
seen in Figure 5. In the Action menu next to 
firmwareUpdatesAvailable. pkg, select Install then 
click the Add Package (s) button. 
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Figure 5. Custom-Triggered Policy Package Selection 


Figure 6* Custom-Triggered Policy Plan 
Smart Computer Group 

Once the two policies above have run, the package 
firmwareUpdatesAvailable, pkg will installed on any 
managed Macs with available firmware updates. We can now 
create a Stitm Computer Gix>up containing all Macs with a receipt 
for this package. If you are hmiiliar with creating Smart Computer 
Groups with die Casper Suite, you may skip this section. 

To create our Smart Computer Group, wee'll log in to our JSS, .select 
the Management tab, dick the Smart Computer Groups link, 
and then click the New Smart Computer Group button. Tliis 
take.s LIS to the Edit Smart Computer Group interface. Here, 
we will type Firmware Updates Available in the 
Computer Group Name i field. Ihen, w'e dick tlie + button next 
to Receipts Info. lliLs opens a pop-up window, wheie we will 
dick Packages Installed By Casper, This adds a line 
under ilie Receipts Inlb header called Packages Installed By 
Casper. Well leave the drop down menu set to has and click the 
ellipsis next to the text field. This will present us with a pt^p 
up window listing all of the ixickages that the Casper Suite Is 
currently tracking. We'll click 

firmwareUpdatesAvailable,pkg in this list, which will 
peculate tile text field and return us to the Edit Smart 
Computer Group interface. At this point, our interface should 
kx)k like Figure 7. Click the Save Group button to save the Smart 
Computer Group. 
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Onc^e ag 3 in, selea the Advanced tab, dick die Update 
Inventory checkbox, then dick the Save Policy button. 
When you're finished, the policy plan should look like the plan 
showm in Figure 6. 
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Figure 7. Edit Smart Computer Croup 
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Once you save the Smart Computer Group, you are taken to 
a list of all Smart Computer Groups in your JSS. If you click the 
View Members button next to the Firmware Updates 
Available group, you will Ise shown a list of all Macs in your JSS 
that have a receipt for die firrawareUpdatesAvailable.pkg 
piickage^ lliis is the same viev^^ you would see if you ran an 
advanced search in your JSS- Inventory fctb using die Firmware 
Updates Available computer group as your setirch criteria. 
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Figure 8. Firmware Updates Available 
Smart Computer Group Members 


Conclusion 


By using dummy jxickages, you can extend die management 
capaliilities of die Casper Suite to allow you to group computers 
based on criteria diat are not built in to the software. Ilie dummy 


package technique has been used to track such items as Active 
Directory group memliersliip, battery cyties & cliaige capacity 
computers widi a Vtindows installaiion and many more. Any 
infonnation you can test for in a script can be used as criteria for a 
duiiuny package. Tills technique is limited only by your 
imagination and your scripting skills. 

For Further Reference 

As mentioned diroughout thi.5 article, you can learn more 
alii3ul the various functions of the Casper Suite from the Casy;e?- 
Sidle 6,0 DiKumentadon availalile at the link lielow. 

http:/ / jamfsoffware.com/tibrories/pdf/suppori/ Casper__Suite_ 
DocumentoHon. pdf 
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New Tools for Collaboration 

Introducing Microsoft 
\ SharePoint Designer 2007 

» An indispensable tool on any 
Sharepoint Website 

by Penelope Coventry, MVP Sharepoint Server 



Introduction 

In lx>iti tlie June and July 2009 issues, 
MacTech Magazine has covered Microsoft 
SharePoint and how OS X c::in integrate with it. In 
lliis article you will learn about SharePoint 
Designer, whether it is Uie <inly web editing trx)l 
you sliQuId use on SharePoint sites, who it is 
targeted for, and what it can do for you. ShaiePoint 
Designer, at this time, only aias under ^^ndows, 
but may be compelling enough for you to nin 
under a virtualization product, such as VimuUBox 
or VMWare, If you use Sharel^oint in your 
CJigjinization, whether you are an Inlbmiation 
Worker, an IT Pro or a developer, you should read 
tills article. Once you start using it you may find 
tliat you can't do witliout it. 

What is SharePoint 
Designer? 
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Figure T SharePoint web page open in the WYSIWYG document window 


ShareR>int Designer b a w^JxxIiting tcxil 
witli an emphasis on building solutions on top of 
Windows .ShaiePoini Services 30 and SharePoint Server 2tX)7. Like 
many other web editing tools, it provides a dexurnent window, 
similar to any word processor, such as MicTosoft Word in which 
you can visually amend content in a "'What Yciu See Is Wliat Ycxi 
Get" (WYSIWYG) environment. In fact, it Ls the only web editing 
tcx)l on tlie market that alk>ws such a visual environmenl with 
SharePoint sites. This enables you to nmnipulate components, such 
as, lists, libraries, master pages and page layouts, by using Uxilhars 
similar to other Office client applications. Using ShaiePoint 
Designer you can cTJStomize tmd develop business solutions Ixised 
on SharePoint teclinologies without writing sender-side code. 

You may nev^er have of heard of ShaiePoint Designer before, 
and therefore you may tliii'ik that this is a first generation product. 
However, it l3een around since 1995, wiien Microsoft Ix^ught from 
Veneer Technologies, Inc,a product Which they then named 
Frontl^ge. In tlie middle of this decade Microsoft took the engine 
out of Frontpage and produced two HTML editing tools, SharePoint 


Dc'signer ^ind Expression Web. 11' you opened tliese two tools side 
by side, liack in 2(X)7, you would initially find it hard to tell them 
apart. Using either tool you can complete similar tasks, such as 
creating and customizing a mixture of web pages (HIML, ASP, 
^VSPX), branding your web sites l>y iminipulating Casaiding Style 
Sheets (CSS), configure ASP.NET controls, plus w'ork witli XML data 
imd external data scjurces. However SharePoint t>esigner is planned 
to be used with SharePoint sites and Expression Web W'iU NOT 
even open a w^eh site based on SharePoint. 

Since their release, SharePoint De.signer and Expression Web 
have gone their own way. SharePoinl Designer, as you would 
expect, has follow^ed the update and .servic’e pack schedule of 
Windows SharePoint Services (WSS) and Microsoft Office 
SharePoint Sender (MOSS), wffiereas Expression Web is now on at 
version 3*0^ Expression Web 3-0 has become more standards 
compliant, incorporating newer W^eli technologies, for example, 
Silverlight, AJAX; allows you to write web sites to take advantage 
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of new technologies in Internet Exploier 8, suppoits wei> editing 
PHP sites and integrates witli VisLial Studio Team System. Tlierefone, 
use SliarePoint Designer for ShaiePoiiit sites and Expression Web 
or anotlier web editing tool for non-Sha re Point sites. 

So what's the liiggest news for SharePoint designer? In the last 
tliree months Micro^ift announced that iPs free! 

Microsoft Office SharePoInt Designer 2007 

* Customise SharePoint with 

t SharePoint Designer 

, Wb 1 : ri^iwienUng « numto i>f dwiQes to tyww** 

1 arKf mor« □u*ioni«6icneffertt.w 

ttH-^ rkducftno making 
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Figure 2 SharePoint Designer is FREE! 

It was never tiundled into any of the Office client suite 
bundles such as Office Ultimate 2007 or Office Small Business, and 
you originally had to purchase it. However, from April tliis year you 
can download it by clicking Etownload for free on 
http://www.microsoft. com/spd at no cTOt. Expression Web is still a 
tbr*pay product, but at least with Expression Web 3.0, you also get 
Expressicm Ik'sign 3 and Expression Encoder 3- 

Is this the only tool to use on 
SharePoint sites? 

Well no. In any SharePoint iniplemenhUton, a range of tools 
will I:k^ u.sed: the biow^ser and Office client applicalions, ShtirePoint 
Designer and Visual Studio. These three tcx}ls represent a 
continuum of ciistomixation c’ap^ihility and the lev^el of skills 
required. 

At one end of the continuum, the two Sharel^Jint products, 
Windows SliarePoint Services (WSS) 3.0 and SharePoint Server 
(MOSS) 2007 are designed to allow ow'ners of content to add 
content quickly and simply ro SharePoint sites. Such contributois 
need no knowledge of web tedinologies, allowing users to easily 
complete tasks tliat were traditionally cx>mpleted by higlily skilled 
technical users. Content owners used to email tlieir content to tlie 
rr depttrtment, the Web inaster or Web hasting comjyany. Content 
on sites beamie dated witii tlie result tliat the numlx^r of visitors 
decreased. Ksseniially, the Web Master was die lx:)ttleneck. 
SharePoint tedinologies reduce die Web Master lK>tt]eneck, as 
content owners niiun tools will l>e eitlier a browser or Office client 
applications, such as Word or Excel. Tills new way of working does 
not come without problems. Content owners may lie unwilling to 
take on die responsibility of publishing their own content, w^hich 
resulLs in a change to business prcx:eases, Also, a Web Master may 
lie unwilling to r^iise their skilJ-level, or not have the time to 
develop dynamic soludons rather than adding staiic content. 


At the other end of the continuum, comprehensive 
castomi^ntion will still be needed and can be achie^^ed using Visual 
Studio. Such development is no different than developing other 
Web ba,sed solutioas and may require .significant developer time, a 
numlier of environments to implement stmemred deployments 
from development, test to prcxluction SharePoint servers. 

SharePoint Designer is a very jxiwerfiil tool in die middle of 
die continuum, and complements the use of the btow^ser on 
SharePoint sites radier than replacing it. You need to know how to 
List* die browser witli SharePoint site and undei^and the out-of-the- 
Ixix Web Parts sci you don’t reinvent funaionaJity that is already 
present. 

SharePoint Designer, sometimes allows you to customize and 
develop data driven SliarePoint web sites quickly widi little 
knowledge of web tedinologies and then tliere are solutioas diat 
may take time io develop tliat may rec|Uii’e modiiicatitin of die 
underlying code, Therefore, for some users the experimenting and 
investigation aspects of developing a solution widi SharePoint 
Designer may he new^, fmstrating and initially unfriencJJy compared 
to other tcxils diey may lie used to. 

Who should use SharePoint 
Designer? 

Don’t Ixf put off fiy its name; it’s not aimed at just web 
designers. Everyone who's had some training into iLs use should use 
SliarePoint Designer - ex|x?rienced infonnaticjo workei^, designers, 
business analysts, project m^tnagers, administrators and developers. 
Neither is k a tool diat should Ix" used by everyone, but it does have 
a very dominant role in any SliarePoint installation. Just rememlier 
dial in many cases, it is easier, quicker and safer to use die hrow^ser. 
SharePoint De.signer in untrained hands can caused unrecoveralile 
damage, which wall result in the TY department looking for the latest 
g(Kid backup. 

Also, althtiugh you can, it shciuld nt>t be used for adding static 
con ten I to a page - use the browser, SharePoint page diat 
includes Web Part zones and the Content Editor Web Part or if it’s 
a Web Content Management page, it will include an HTML held 
control on die page layout. Dcai't reinvent the Web Master 
bottleneck, where the bottleneck now- becomes you! Use 
SharelY>int Designer to CTeate solutions that are easy to maintain 
and suppoit. Tyjiically, any oi^anization that uses Sli^irePoint 
should use the browser to achieve 75 percent of the necessary 
customizations; SharePoint Designer for 15 percent and a developer 
skilled in Visual Studio for 10 percent. 

So if tlie majority of oxidifications only need to use die 
browser and Office applications, how can you stop people losing 
SliarePoint Designer? With SharePoint Designer free, downlaadable 
by anyone, ant) if your organization does nor restrict wEat prexlurt 
is installed on your employee’s desktop or if your employee can 
access the SliarePoint site from home on dieir owm computer wdiere 
again tliey* c'an iastall wdiat dicy like - what can you do? I'he 
Microsoft SharePoint Designer team blog has a detailed post on tliis 
suliject; however, I recommend diat you should never give a person 
more pemiissions than diey need. SharePoini I>esigner adheres to 
the aiithorizntion rules you apply to your sites, and in the majority 
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of cases most users only need to be mpped to the contribute 
pennission level on any SharePoint object. Only map users to tlie 
Full Control or Design permission lev^eLs if they leally need those 
levels of access. 

Why should you use SharePoint 
Designer 

Well basically, there is no odier tool that allows you create 
solutions as quickly as SharePoint Designer and is seen by Microsoft 
as one of the premier products to grow user adoption of 
SharePoint. The most compelling uses of SkuePoint Designer are: 

Data Form Web Part 

This Web Part, also known as tlie Daui View Web Part, is the 
Swiss army knife of Web Parts. It enables you to do almast anytliing 
you like, and tliis Web Part oirmoi lx? created using tlie browser. 
Tlie Data Fcirm Web Part allows you to crmte data driven solutions 
based on XML and extensible Stylesheet language Transformations 
(XSLT) technologies, including creating custom views of business 
data exposed by the SharePoint Server business Data Catalog 
(BIX:). In many cases using this Web I^arl negates the need for a 
developer-created Web Pan or at the very least allows you to 
prototype a solution, investigate the exact bicsiness Tequirements, 
tlierehy justifying business expendituiie and reducing the time 
needed during the software devekipment life cycle - if you do find 
you need a developer-created Web Part, 

Connecting to a data source 

SliarePoint enables connexions to other data sources, such res 
datalxises: SQL, Omcle, MySQL; XML Web services, RSS feexis as 
w^ell as lists and libraries on oriier SiiarePoint sites. Tliis is very 
useful in a WSS-only instillation, such as Small Businc's.s Server, 
where you c'an quickly present die data from diesc disparate 
sources into a unified view. If you iiitve MOSS installed and you 
want to present the same dam over a laige numl>er of sites, and you 
are using die SDC or die Business Intelligence feature.^, these 
definitions cm also lie used from witliin SharePoint Designer to 
design pages allowing you to create mash-up solutioas and 
aggregating content dmt is related but live on many dispamte 
sources. Using die Dam Fonn Web P^irt cun not only display 
diita from diese dam sources, but you can also create data entry 
forms that can update diose data sources - all using the dexjument 
window a aiuple of msk p^meu and with no server-side ccxle! 

Building interactive solutions 

SharePoint adds additional functionally to Web Part 
connections. Web Part connettioas allows tlie user to interact with 
the data with the result that the data displayed on the page can 
dynamically change matching the user’s business need and not 
restricted to preconceptions of the business analyst or developer. 

For example on one part of a Web page there could be a list 
of h{xspiml wurds, A nurse or doctor could click one of the wards 
and a iLst of patients would display on another part of the page 
together with the name of tlie staff nurse on duty. Using the 
browser, tliis was as far as you cxiuld go. With SiiarePoint Designer 
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you can pass data from a Web Part on one page to one or more 
Web Parts on another page. Tlieiefore in the ward/patient scenario, 
a nurse or doctor could then click on tlie patient name, they would 
lie redirected to a second page where detailed patient information 
is displayed, such as, a picture of die patient, their age, sex, a list of 
their allergies, the medicine administered, tlie time and amount, a 
graph of tlieir temperature and blood pressure readings with those 
reading above a cdtical tlireshold liighlighted in led; who tlieir local 
doctor is, their consultant and so on. 

Most of this data on the second page is displayed using - yes, 
youVe guessed it - with the Data Fonn Web Part. It miglit require 
someone widi knowledge of XSLT and the use of tlie code view' 
window, but this sexfnario is achievable with just the use of 
ShitnePoini Designer. 

Workflows 

Using the browser, SharePoint provides you with a number of 
W'ays to help with business prtKesses: Alert Me, RSS feeds and 
aejiting woricflows on li.sts and libraries based on a number of 
w'orkflow' templates. SharePoint Designer extends the number of 
workflow's you can create using a workflow' designer wizard W'here 
yfiu can choose the cx)nditioas and the subsequent actions if the 
conditions are met. 
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Figure 3 SharePoint Designer workflow wizard 


Thexe are some limimtions creirting vvorkllows in SharePoint 
Designer as compared to creating workflows witli Visual Studio. 
SharePoint Designer W'orkfiow's iire: 

• Btjund to one list or library; not easily tninslerable to other lists 
or libraries, althougli tliere are a couple of projects on codeplex 
(www^codeplex, com) tiiat niight help you if you do want to 
transfer tliem, btii you are back into the developer domain for 
this, 

• Execute .steps in sequential order, alLh{)ugh witli a bit of 
imagination it Ls pcxs.sible to implement a state like workflow. 

• No debug capabilities, 

• No support for mid process changes, 

• Execute under the permissions of the user who starts tlie 
workflow'. 

Having said all that, howo'er, even though there is a learning 
curve on how to create SharePoint Designer workflows, they are in 
general easy to use and have a simple one click deployment, abide 
it Is an in-place mechanism, tliat is, you usually create and test them 
on the live SharePoint environment. 
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Site Templates 

Once you haw created your solutic^n, you can package it up 
into a site template, which can be used to create new sites that 
included that new funciionality. In fact, Microsoft has released a 
number of site templates that were cteaied using SharePoint 
Designer, that can be used, to extend your knowledge of how^ to 
create solutions using SharePt^int Designer. These sample site 
templates are knowm as the fabulous forty. There is a whitepaper, 
''Application Templates for Windows SharePoint Service: Under the 
Hood”, tliat explain how they were built together with a numlier of 
blog posts on the SharePoint Designer team blog. 

Administration Tool 

SharePoint Designer also provides a number of administraiive 
tools, fn^m hacking up a site and, optionLiUy, its sub-sites, creating 
sites, lists and libraries, liiciing lists, libraries Lind folders from users 
w^ho use the browser Lmd a numl>er of repofts. 

Getting started with SharePoint 
Designer 

Unlike other web developments you may lie used to, you do 
not use SharePoint Designer on a web site CTeated on your Icxal 
drive. You need SharePoint, either Windows SharePoint Services or 
SliaiePoint Server installed prior to using SharePoint Designer, You 
connect to tlie SharePoint site you wish to modify using http: or 
https: just as you would connect to a SharePoint site using tlie 
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browser. You never open files directly on the local drive, e.specially 
on a SharePoint server. If you do so then you may corrupt those 
fJes, tlierefore, you should never insiall SharePoint De-signer on 
Windows server where SharePoint is installed. 

Also you will need to install SliarePoint Designer using 
virtualization, Bootcamp, or a physical Windows box running XP, 
Vista, Windows 7 or a Windows Server operating system. You need 
.NET Framework 3-0, if you want to use the WYSfWYG 
envirernment and create workflows with SharePoint Designer. Once 
installed, click the Start button, All Programs, Microsoft QflSce, and 
then click Microsoft Office SharePoint Designer. From the File 
menu, dick Open Site and then type in the address of tlie 
SharePoint web site. 



Figure 4 Opening a SharePoint site 
with SharePoint Designer 

Controlling Change 

All ShttrePoint Ik^igner irKxlifiaitions are at the site level with 
tile modilreations saved in the SharePoint SQL content databases. 
When you use Sli^irePoint Designer many of your moditlcations can 
only Ire done on the live environment that is in situ. The>^ refer to 
lists or libraries by a randomly generated numixr, a GUID, and not 
the name of the list or library' and cannot l:tc easily transported or 
placed on other sites. Tills can sometimes lie overcome by 
switching to code view' and replacing the GUID, by llie list name. 
Similarly tJieie are other tricks you can do. For example: developing 
the Data Form Web Part on a separate page on tJie site where the 
Data Form Well Part is to lie u.sed or within the same Site Collection 
and then exporting and importing the Web Part, or develop die 
Web Part against SharePoint’s XMI. Web services. 

lliere are a hniited numlier of modificatioas, such as creating 
new master pages and CSS files that you can use SharePtiint 
Designer to complete, say, in a de\eiopment environment that can 
tie packaged and are therefore similar to modification created using 
Visual Studio. 
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Either way IVe found it u^ieful to plan right from the ytart to 
develop a SbirePoint Designer solution witli pc.)rUibility and 
Kuppf;jrtability in mind. It’s not always passible^ but Tm often 
pleased that, ff^r example, I did save the XSLT in a separate file 
pointed to by the Dafci Form Web Pan rather than leaving it 
embedded m the Data Fomi Web Part in the SharePoint page. 

What does the future hold? 

When Microsoft made SharePoint Designer free in April, they 
also stated that tl^ey were working toward st^me time in tlie Ihture 
when Expression Web would l:)ecome an excellent choice for 
SharePoint customiziition. So tliat’s tlie future. Wliat alxjut what's 
going 10 litippen tliis year and next year? Well, SliaiePoint 2010 Ls 
around die comer, witli tlie public t>eta later this year widi die 
release to manufacturing in the first half of 2010, Tliis should see the 
next vmion of SharePoint Designei^ released as well - and ids going 
to be free again. To get an early peak at what the new vei^ion looks 
like, view the scteencast hcxsted by Tom Rizzo, Senior Director, 
SharePoint, on http://sharepoinlmicrosofhcom/2010. More 
information will be released in Octolier at the SharePoint 
Conference at Las Vegas. I cran’t wait, and I hope to see of you there. 
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Glossary: 

• AJ AX - AsynchronoLLS JavaScript and XML. A Web development 
language for creating interacdve Web sites. 

• Business Data Cauilog (BDC). A SharePoint Server 2(X)7 featuie 
that provides connectivity to tiackend business systems and clabi 
sources whose data Ls present through the SliarePoint interface, 

• Data Form Web Piirt (DFWP). A Web Part also known as the 
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Data View Web Part, that reads dam from and WTites data 
to a data soiirce in the form of XML and applies XSLT to 
it. With SharePoint Designer you can add a DFWP to a 
w'eb page using tlie WYSIWYG document window, so that 
you don’t need to know XSLT. 

• Fabulous 40. Additional site definitions and site templates 
for Windows SliarePoint Services 3.0 tliat are examples of 
solutioas and customixatioas that are possible, 

• Glolxilly Unique Identifier (GUID) a unique 128-bit 
numl^er that identifies components in SharePoint. 

• Master Page, A special ASP.NET 2.0 web page tliat defines 
code tliat can lx* share code between pages. Tlieir primaiy 
use Ls to provide a Web site with a coasLstent look and 
feel, and navigatir^n for each page within a site. 

• Page Layout. A key component of SharePoint Server’,s Web 
Content Management functiona!it>^ that defines the 
position and Itxution of content of publishing pages. Used 
in conjunction with a Master page. 
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Demystifying PKI: 

Enterprise Environments - Part 4 

A Series of Articles and How-Tos about PKI technology 
in the OS X environment 


By Michele (Mike) Hjorleifsson 




Part Four: Putting PKI To Work For You 

List monili we discussed tlie deployment of an enteq^rise 
cltLss Cx.'rtiricate Authority and how to pnxeet your keys. I1iis 
montli we are going to put our PKI loiowledge to practieal use. 
Since you spent tlie time de})loying a CA it's woitli looking at what 
PKI can lx* used for. There are a myriad of security and assumnce 
implementations that u.se PKI today, mtxsi of which work so well 
we baiely give them any thought, ll Is worth a ciuick review to 
ensure you get tiie mtxst out of your PKJ infrastniciure, 

PKI implemenUilions am lie liroken down into four general 
categories: 

Digital Signing 

Digital signing is the utilization of a PKI key and an asscxiated 
algoritlim (such as SHAl or S1-1A2) that is run against a piece of cbtUi 
to create a signature, Aldiougii it sounds complex, you may not 
realize that you use these all die time. Software* Updates from 
vendors like Apple, Microsoft, GtK}gle and dx)Usancis of others use 
a signatuie to ensure dial their update reaches your device (yep, 
that includes die iPhone) tntaet and untouched by outside forces. 
All applic-adtais on die iPhone have to utilize a digital signature to 
verify audienticily. Odier conunon uses of digital signatures include 
die replacement of a physical signature in contractual docaiments 
such as l^DF files widi a digital signature and, digitally .signing 
emails to assure recipienLs that die email in hict came horn die tided 
author. More complex applications include digitally signing 
requests to modib^ DNS rec’ords, referred to as DNSSEC (DNS 
Seairit>d or digitally signing network roudng requests, referred to 
a.s SIDR (Secure Internet Domain Routing), A newer 
implementation is to utilize digital signatures to ensure the 
authendciw of video files sLich as videti recorded depexsitions. 

Encryption 

Encryption and digital signaUires are commonly confused. A 
digital signature is a signature created by mnning a mathmadad 
fonnula against a piece of data w ith one of your keys to imke 
changes evident. The original piece of data is not afTected, whedier 
it is an applic^ition, a PDF file, a word dcxrunient and so on. 
EncTyption on die odier hand actually utilizes die PKI key to make 
the data unreadable to anyone without the corresponding keys and 
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actimlly acts on the data in question. You can encryiiit dexuments, 
e-mail messages and even network tnifilc to keep prying eyes from 
kx)king at sensitive infoiimtion such as pers<_->rLal data and aedit 
card infonnarion. If you have ever purchased something on the 
Internet from an SSL-secured site, you have used PKI-based 
cnciyption. 

Authentication 

Smart caids have been around for some dme. lliey utilize PKI 
credentials issued to an individual to allow that person to verify 
their identity to an o|ierating systejiu or a website etc, Tlie problem 
widi smart cards to date has lieen the reciuireinent of an external 
reader. There are several manufacturers that provide USB stick 
smart card solutions that include the reader and secured storage for 
your certificates on a small p>itahle USB stick, without the 
requirement of an additional reader. Companies like BestToken, 
Gemalto, and Centrify provide OS X compatible smart card 
solutions. The drivers and underlying frameworks for these 
solutions are built in to OS X Leopard, lhat Ixfing said, you aren’t 
limited to using smart cards for autlientiattlon. Once your 
credentials Lire issited you can simply store tliem in your keychain 
and use tliem to autlientiaite to wellsites, or w^eb applications. 
When keys are created for you as an individual, they can be 
“pemiissiond” to act as autlientication and signing credentiaLs, 
Alierniitively, two .sepLiraie seLs of keys can be issued depending on 
your preference. You can add protection to tliese keys by requiring 
a passphrase—I higlily rectaiimend tliLs. Use a PIN code because 
they are easier to lemember and without the piiysical key and PIN 
ccxle the key is useless. We will examine protecting a website witli 
PKI keys later in this article. 

Authenticity 

So what is the difference between authentication and 
authenticity'" In tliis context, PKI can be used to authenticate the 
validity of li person, computer or other item. For instance 802,lx 
network autlientication is a standard used for securing acc'ess to a 
network at the wired or wireless layer, prior to talking to any 
servers. You can issue PKI certificates to devices (such as laptops) 
to allow access to tlie network or you c^n do it by user. Printers 
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commonly use PIQ certificates to check the autlienticity of tlic toner 
cartridge you put into the printer. Wireless providers utilize 
autlienticity c^rtific'ates to easuie tlie dev ice connecting to their 
wireless network is an authentic device provided by that c^amer (or 
allowed by that carrier). Sounds expensive righl^ In today's market 
the certificates tliai ate needed to enil:)ed into product packaging 
or the electronics of a product can he bought in bulk lor about a 
dollar or less dei>ending on quantities. The bitsines^s question is 
simple: Is it worth the dollar to ensure the authenticity^ of the device 
or product? Well, for things like ceil phones, controlled 
phamiaceutical sultstances, toner cartridges and many others the 
answer is currently, ^'yes" 

OCSP (Online Certificiite Status Prottxx)!) servers become 
cTUcial in larger environments or commercial implementations such 
as product authenticity. G:>mpanic^ need the ability to test and 
validate whether a certificate diat Itas l>een Issued is still valid, 
expired or Ixeen revoked. Ftir instance, il' you didn't pay your cell 
phone bill, in tlieory, the wireless provider could revoke your 
devices certificate or just suspend it until the bill is paid. 

Now for tlie fun jrart. let s pul this knowledge to use. Utilizing 
either the OS X Certificate Assistant or the EJBCA server you set up 
in either of the previous two articles, Issue yourself a certificate and 
make sure to include your email addiess (as it appears in Apple 
Mail) in the appR>priate field. Eitlier metltoti (Certificate Assistant or 
EJBCA) will create the certificate files. Double click the file to install 
it into your keydiain. You will get a dialtjg tliat looks like tliis: 


Add Certificates. 


Do you want to add the certificate's) from the file 
“MyCeit.cer'* to a keychain? 



C View Certificates ^ 


Keychainr [ login 


m 


( Cancel } f - OK 


Figure 1 - importing a certificate into the login Iteychainp 


Ihc Keychain default is set to login which is the correct keychain. 

Onci? installed you w'ill need to trust the certificate. As you can 
see in the foEowhig image, you can trust tlie certificate for all the 
|X‘mii,ssions provided by die certificaie or select die items you want 
to allow^ the certificaie to lx u.sed for. In our case we will just trust 
it entirely st> change the top drop down Hst lx>x to Always Trust 
and provide your cTedentials w hen prompted. 
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Figure 2 - Certificate trust 


If you had Apple Mail open, dose it and tlien neopen ii. Apple 
Mail Ls smart enough to detect tlie new ccitifiatte if the email 
address in die certificite matches one of your email accounts. Now, 
compose a message and you will notice two new icons on the left 
hand side of your message under die suliject line. One looks like 
a lock and the other kx>ks like a stamp you may have received as 
a 2nd grader for gcKid work. The stamp will have either an X in it 
or a check mark. The lock represents the enciyption status of your 
message (more on that in a minute). 


*m»iuart*ititcn4hfTit.cotir' ?• StgnATure: Non* IT] ^ ^ 

Figure S - IVIailvapp with certificate support 

The stam[i repi esents the digital signature status of your email 
If the staniji is checkcxi, you will lie digicilly signing your email 
widi the certilicate you just installed. You can always shut c)fT the 
signature by clicking die icon. You will not see any difference in 
die email itsell. Why not? Good question, Tie digital .signature 
enables S/MIME (Secure MIME, or Multipart Internet Mail 
Exteasiofis) which is embedded in the header of the email not in 
die visible body. Mtjst email clients (including Outkxik, Notes, 
Thunderi>ird and Apple Mail) will automatically recognize digitally 
signed emails. However be aware that fax services .such as e-fax 
and niyfax do not like cligiUil signatures on outbound faxes so be 
sure to shut off digital signatures on any outbound faxes. 'Hiar was 
easy, but what did we accomplish? Eveiy^ signed mail you send 
frf)m that pcant foiw^ard will assure the recipient that it was sent 
from you and no one else and that it wasn't uimpered with since 
you authored it. This is pretty inipomnt in many scenarios. 


Signature; 


None 




Figure 4 - lock icon showing encryption. 

The IcK-k is the other item you can enable and disable, but 
only if you have previously accepted a certificate from the recipient 
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you aie sending the tmil to* Seems confusing hut let’s re\iew the 
concept. When you send your mail with a digital signatuie, the 
recipient can dtjuble click the seal icon and tlien accept your 
certificate and send you a signed emaii in which you will do the 
same. Now that you each have the cAer’s pLiblic key, you can 
create an email and encrypt it with the public key of the recipient. 
Only the recipient can open the email because tlie recipient is the 
only one with the private key, which lias not been shared with 
anyone. So wliat is tlie difference l^cw'een signing and encrypting 
the emails Simple; signing just validates you as the sender and 
indicates w'hetlier the email was tampered with since you sent it. It 
DOES NOT hide (tlirough encTyption) any of the contents of the 
emaii. When you need to send private or .sensitive information 
encrvption is appropriate. When you are just sending standard 
enuils, a signature should be enough. 

You can aLs<i use the same infrastnacture to Issue certificates 
to users whom you want to have access to protected web content. 
First, you issue the certificates to tlie users and liave them install 
the cerdfic'iUes (tlie same way you just did) or use Apple Remote 
Desktop (or any other tool) to deploy the certificate automatiailly 
to tlie client macliines/accounLs in question. Once installed and 
tmsted you can mcxlify the settings on your server and install a 
couple of flies witlioui changing a line of web code. You w^ill need 
a copy of tile CA ixKit public certificaLe to accomplish tllis. You can 
e.xport tills e^Lsily in ceriificaie assisUint if dial is htw you are 
issuing your certificates or on EJllCAJjog on to tlie administration 
pages and then go to the configuration. You can download the 
certificate as a text file. From there, you want a PEM based file 
formiit and for our case here we will stive the file as “ca.crt". Now 
that you have tliai file, log into your OS X Server or open Server 
Admin. Selecu the web service, and tlien select the Site you want 
to mtxlily’ Click the ofitions tab (as shown) and turn on Allow 
overrides. Your website should alre^idy lie using SSL, if not click 
on SecLiriw and change it to enable SSL and ensure you have a 
proper certificate installed. 
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Figure 5-Server Admin web site options. 

Next copy the cn^cit file to your OS X server (if it is different 
than the server you have the file on now) and put it in a safe 
director^^ For this example, let’s use /library/WefiServer/. Create an 
empty file called .htaccess and place it in the rcK>i of the wub 
director^’ of your site. Next, open it with an editor and place the 
following lines inside: 


www.LC-Tech.com/offers | (866)603-2195 


WWW.MACnCH.COM 














Network, Server 
and Appliance Monitoring 

For Mac OS X 



Xserve (Intel & G 5 ) 


Xserve RAID 


Airport 


Lithium Network Monitoring Platform 

Lithium can now monitor your Xserve, Xserve RAID, 
Qlogic switches, Airports, Mac OS X Server... 
and everything else in your network. 


www.lithiumcorp.com 


lithiuiio.. 



































macforge.net 

mS TM 

MacForge indexes and tracks open source 
projects that run on the Mac, or are likely to 
without further modification. Thanks to 
MacForge, there's no need to sift through ' 
huge listings of open source that you can't 
use. With categories, filters, and more, 
MacForge makes it easy to find 
what you need. 

MacForge: 

Your Gateway to Mac Open Source 

www.macforge.net 

Sponsored by M/XnCH 


■BUMDL£D PH 0N£^ 
glNTERN£T.S£fiVIC£ 


naaaeoBE) 

H!CS 7 Q 3 D 

DyiKimicAll{i(atk)n T-1 
Up to 16 Sinine» Un«s - 

Unltmited lofol Service 
Unlimited Site to Site Colling 
Jf.OOG lfenut» of tcag DhtentB 
Of Toll Free 

Voice Unit Coll Forwarding. 3-Vi^ Colling, Coll Hold, 
Pickup ond Trgnsfor, Coil Woiltng, Lost Number 
Redial. DIU. grid DOD, Caller ID ond motel 


SSLEngine on 
SSLClpherSulte 

ALL 1 ! ADHi 1EXPORT56 1 RC4’FR£A :-FHIGH :-f«EDIUll; -FLOW: -FSSLv2 :+EXP :+eNULL 

SSLCACsrtIficareFi1e /Library/WebServer/ca.c rt 

SSLRequireSSL 

SSLVerifyCllent require 

SSLVerifyDepth 10 

That's all there is to it. Now if you try to access the site you 
may get a certificate warning message (that's if you are using a self- 
signed certificate and haven’t installed that certificate on your local 
iTiiichine), Next, you are prompted to specify which certificate from 
your keychain to use for authentication. Select the appropriate 
certificate we installed earlier and voila. No more logons necessary, 
no realms to manage, no calls to the helpdesk to reset passwords. 
Single sign-on even from remote kx:ations as long as tlie client has 
the appropriaie certilicate installed. Tip: 1 recomniend that when 
issuing user certificates tliat you enable a passphrase and use a 4- 
6 digit pin. Users tend to remember pin numbers. And, if you are 
using EfliCA asers can logon and self .seivice their own PIN 
without your iissisUmce, It adds another layer of seexirity without 
another password which, as we all know, incurs helpdesk calls. 

You can extend the funaionality to perform live OCSP checks 
on the certificate and to check for immediate revocation status. That 
is a little bit beyond tlie scope of tliis introduction but more 
infonnation is available at http://apache,or 9 and 
http://www.a&kapod>e,com. 

Errata 

A c[uick note, tlie download information on EJBCA’s OS X 
implementation in last month Is article is incorrect. The version was 
removed fre^m the site temporarily. It is lieing ujxlated to utilize the 
latest version of EfBCA and provide an OS X client as well as seiver 
installation. Also, the underlying ckitalxtse is lieing switdied from 
MySQL to Ingres due to the uncerLiin future of tlie MySQL datalxise 
platfomi given tite |:>ending purdiase of Sun by Onicie. Ingres is 
another poweriiil open source datalxise piatfomi that provides a 
similar licensing model, free community editions and paid for 
support and training. Ingres is acmally designed from the ground 
up for deployment in the enterprise, for more infonnation on 
Ingres ,see http://www,ingre 5 ,com 

Finish 

Thank you for spending tinie letuning alx>ut the mysrical 
world of PKL I hope these articles have shed .some light cm what 
PKl is md htjw you can use it in your infraslmctuie. 
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THE MACTECH SPOTLIGHT 

J«ff t)og«r 


Spldeimvelb Softniirei.j:*e 






What do you do? . 

I'm the prei^idenl of Spldeiwb Softvt^am, I dtisign nod axle the games. 1 alsti ---— 

provide direction to the artists, both out and in house. (We liave tiiree fulUtime employees). 

How long have you been doing what you do? 

I startedwriting my first game, Exile: Eseaije From tile Pit for the Mac. in the summer of 1994. So IVe been doing this 
a little over 15 years, 

What was your first computer: 

My first computer was an Apple 11+, oli so very long ago. My first real development machine was a PowerMac 6l0t). 

Are you Mac-only, or a multi-piatfonn person^ 

I w^nte my games for the Mac first, and then I port them to Windows. 

Being “Mac first," how do you manage the port to Windows? 

We wiite e\ eiylhing in C++. For porting. 1 just adapt the code hy liand, though I have a lot of little in- 
liouse libraries and tiicks I use to make the process to veiy^ fast. 1 generally have a port ready for lmi\ 
testing in 1-2 weeks. Its reall)- fa,si. 

It helps that 1 use OpenGL and a cross-platform sound librar}^ and that, since it's a game, all LU 
elements Cscmlll^ars, etc) are htudeoded. 

^ What is the advice you'd give to someone trying to get into this line of work today? 

^ It's a lotigh way to iiiake a living. There is massive competition, and you have to have a lot of luck, an 

I amazing product, or the tenacit>' of the cockroach to get noticed, 

I The advice I give the most often is to liear in mind rhai your pitiduct lias to be supt^r-gcxid 

to get someone lo pry the cretiiL card out of die wallet, look at the market, If anyone is 
giving anything comparable to your planned game away for free, write Sp^thing else. 

What’s the coolest tech thing you’ve done using OS X? 

Im actually not that great a iirogranimer, I can w^rite a solid, stable product, hut my real skill lies 
in design. So J think the most amazing thing J ve done is umiten a whole, futl-lengih, OpenGL g;uTie for the 
/ Mac Irora scratch and ended up with something that j>eopie would actually pay for. Just creating a decent 

' product of any sort Is prett)' cool 

Where can we see a sample of your work? 

We have large demos of all of our role-playing ^imes ai http://wvw.spiderwebsoftwore.com/ . 

The next way Fm going to impact IT/OS X/the Mac universe is: 

By making sure a year never goes by widiout a good RPG coming out for the Mac. 
__^ There have been years whee the 1:5ig Mac has l:jeen liy me. 


Anything else we should know? 

We'm fndie, and we’re proud of it. 
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If ym or someone you know Ai the tSacledi kt us knovf! 

, _ defies to eiStoriid@maaedLam 
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WWW.MACIECH.COM 









mac TO SCHOOL 

It's Mac shopping made easy. Grab that checklist, and prepare for 
some one-stop shopping at Smalldog.com! 

BUnoies simPLiFY THe BUYinG PROcess 

Mac bundles (think Mac + software + RAM + AppleCare + external hard 
drive, etc.) not only include everything you need, but also save you money. 

Visit» Smalldog .com/specials 


mocs FRom unoeR $500 


We carry all current Macs as well as used, refurbished and closeout models, 
so there is a Mac for any budget. 


Visit» Smalldog.com/macs 

FRee SHippinG ovgr $200 


’ lS'Mac»ookPro* 

CNII Pill® mobile speakers 


It's true-we provide free, same-day 
ground shipping on every item over 
$200 every day. 

TQX-FRee SHOPPinG 

Purchases outside of Vermont are 
always shipped tax-free. 




Small Dog 

Electronics 

AliAJrt^s Ijou.r Side 


www.smalldog.com 

800'511'NACS 

ll Apple Specialist 


Celebrating 15 Years • 3rd Largest Apple Specialist in New England • 5-Star Merchant Rating • Same-day shipping 
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NEW! 

EMC® Retrospect® 8 

backup and recovery software for 
small and medium businesses 
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The most 
trusted 
name in 
Mac 
backup 


Now available for PowerPC & Intel Macs! 

All-new EMC Retrospect 8 for Macintosh provides the reliability, ease of use, power, 
and flexibility you need to protect critical data on Mac and Windows PCs and servers. 
EMC Retrospeet-ineludes a state-of-the-art Mac userrintefface and enterprise-level 
features — including remote management of one or more backup servers, 
disk-to-disk-to-anyf/i/ng backups, Xsan support and custom reporting — at a fraction of 
the cost of other products. 


Download a free 45-day trial at www.retrospect.com/wwdc 


EMC? 

wher^ information lives^ 


